Yes, if the data is coming as "myServer" then [host::myServer] will work great. In regular expressions, alternation is | , so you could do this REGEX=(?s)desktop\$|IPC\$|usr You only need the (?s) once, as it applies to the whole regular expression. Be aware that Splunk uses unanchored regular expressions. That means that if splunk finds one of the strings "desktop$" or "IPC$" or "usr" anywhere in the event, the event will be dropped. If you are going to be writing a lot of regular expressions, you might want to consider picking up a tool, tutorial or reference. There is a brief tutorial/description in the Splunk documentation here, but you can find tons of resources online. ... View more