Refine your search:

Have a tested Regex I am trying to use to keep events. I ran it through some online regex checkers. When I run it through Splunk I am not getting my events. I think it is a case issue, how do I make this entire expression case insensitive?

Props.conf

[vippapp]
TRANSFORMS-vipp1=setnull,setparsingvipp

Transforms.conf

[setnull]
REGEX = .
DEST_KEY = queue
FORMAT = nullQueue

[setparsingvipp]

REGEX = updating status for request \d* to \d|jvm appears hung: timed out waiting for signal from jvm
DEST_KEY = queue
FORMAT = vipp

Thanks

asked 26 May '11, 12:51

dchodur's gravatar image

dchodur
1319
accept rate: 20%

edited 26 May '11, 15:21

jbsplunk's gravatar image

jbsplunk ♦
13.1k7938


2 Answers:

dchodur,

I think the main issue here is with your "setparsingvipp" transforms.conf stanza. You are sending data to the "vipp" queue, which is not a valid Splunk queue. Do you want this to go to the "parsingQueue" instead?

link

answered 26 May '11, 15:19

hazekamp's gravatar image

hazekamp
2.4k1219
accept rate: 38%

1

though, fwiw, you simply prefix a PCRE regular expression with (?i) to make it case-insensitive.

(26 May '11, 17:13) gkanapathy ♦

hazekamp you were correct, need to send to the indexQueue and not the index name, Thanks! I misread how that was to be setup in the documenation.

Here is what is working for me now. Props.conf

[mcvippapp]
TRANSFORMS-mcvipp1=setnull,setmcvipp

[pcvippapp]
TRANSFORMS-pcvipp1=setnull,setpcvipp

transforms.conf

[setnull]
REGEX=.
DEST_KEY=queue
FORMAT=nullQueue

[setmcvipp]
REGEX=(?m)Updating status for request \d* to (3|4|5)$|JVM appears hung
DEST_KEY=queue
FORMAT=indexQueue

[setpcvipp]
REGEX=(?m)Updating status for the request id = \d* from (5|7) to (6|8)$|JVM appears hung
DEST_KEY=queue
FORMAT=indexQueue

Looks like I needed to use (?m) as well. Have not tried the (?i) yet. Thanks for the help. Hope this helps someone else.

link

answered 31 May '11, 13:13

dchodur's gravatar image

dchodur
1319
accept rate: 20%

Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×718
×32
×4

Asked: 26 May '11, 12:51

Seen: 1,647 times

Last updated: 31 May '11, 13:13

Copyright © 2005-2014 Splunk Inc. All rights reserved.