Why is the Splunk Web service not running after an upgrade to 6.2? Learn more »
Have a tested Regex I am trying to use to keep events. I ran it through some online regex checkers. When I run it through Splunk I am not getting my events. I think it is a case issue, how do I make this entire expression case insensitive?
[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue
REGEX = updating status for request \d* to \d|jvm appears hung: timed out waiting for signal from jvm DEST_KEY = queue FORMAT = vipp
hazekamp you were correct, need to send to the indexQueue and not the index name, Thanks! I misread how that was to be setup in the documenation.
Here is what is working for me now. Props.conf
[mcvippapp] TRANSFORMS-mcvipp1=setnull,setmcvipp [pcvippapp] TRANSFORMS-pcvipp1=setnull,setpcvipp
[setnull] REGEX=. DEST_KEY=queue FORMAT=nullQueue [setmcvipp] REGEX=(?m)Updating status for request \d* to (3|4|5)$|JVM appears hung DEST_KEY=queue FORMAT=indexQueue [setpcvipp] REGEX=(?m)Updating status for the request id = \d* from (5|7) to (6|8)$|JVM appears hung DEST_KEY=queue FORMAT=indexQueue
Looks like I needed to use (?m) as well. Have not tried the (?i) yet. Thanks for the help. Hope this helps someone else.