Have a tested Regex I am trying to use to keep events. I ran it through some online regex checkers. When I run it through Splunk I am not getting my events. I think it is a case issue, how do I make this entire expression case insensitive?
I think the main issue here is with your "setparsingvipp" transforms.conf stanza. You are sending data to the "vipp" queue, which is not a valid Splunk queue. Do you want this to go to the "parsingQueue" instead?
answered 26 May '11, 15:19
hazekamp you were correct, need to send to the indexQueue and not the index name, Thanks! I misread how that was to be setup in the documenation.
Here is what is working for me now. Props.conf
Looks like I needed to use (?m) as well. Have not tried the (?i) yet. Thanks for the help. Hope this helps someone else.
answered 31 May '11, 13:13