Thanks for your response Rich. I modified the REGEX accordingly and it matched in REGEX101.com ^10.45.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$ On applying that in Splunk under transforms.conf that is not taking any effect. Not sure if I am missing anything in the props and transforms. transforms.conf [setnull] REGEX = \|dest\=^10.45.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$\| REGEX = \|src\=^10.255.(0.([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5]))|([1-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])).([0-9]|[1-9][0-9]|1([0-9][0-9])|2([0-4][0-9]|5[0-5])))$\| DEST_KEY = queue FORMAT = nullQueue props.conf [sourcetype name] TRANSFORMS-set = setnull Please help. ... View more