I've found that it's helpful to have a Regular Expression cheat sheet handy when doing this type of work. There is a really snazzy tool that the people (maybe person) at gskinner have built:
http://gskinner.com/RegExr/
It's a Flash application that will allow you to test any number of Regular Expressions on given text. There is even a standalone one written in AIR which is nice if you're traveling and not near a net connection.
I'm still trying to get the hang of the transforms and props, however it seems to me that the title of the stanzas are up to the user as long as they are consistent. (please, some one who knows better confirm this)
(?m) optionally matches m and (?msi) optionally matches msi
Also, the props.conf spec document is available at:
http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Propsconf
... View more
