×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
jblanton_splunk
Splunk Employee
Member since: ‎08-23-2017
‎06-05-2020
Community Statistics
Posts 2
Solutions 1
Karma Given 9
Karma Received 0
Member Since ‎08-23-2017
Activity Feed
Topics I've Started
No posts to display.
View All

Re: DBX inputs - Filter Events to NullQueue

by Splunk Employee in Getting Data In
‎08-09-2018 06:54 AM
‎08-09-2018 06:54 AM
You're very welcome! You are correct, you'll have to 'escape' the parenthesis you're needing to match for some of the status responses with a backslash character, for example: REGEX=QRS_MSG_STATUS="(\(ACC\)|\(RECEIVE\)|CANCELLED)" ... View more

Re: DBX inputs - Filter Events to NullQueue

by Splunk Employee in Getting Data In
‎08-08-2018 02:15 PM
‎08-08-2018 02:15 PM
Hello rijutha, You'll need to set the quotation marks as part of your Regex capture, and you'll probably want to add the field name as well to prevent it from grabbing other matching strings on accident. Try something like: [abc_defghi_jk_keeptype] REGEX=ABC_MSG_TYPE="(101|102|103|200|202|203)" DEST_KEY = queue FORMAT = indexQueue ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:03 AM