Have a tested Regex I am trying to use to keep events. I ran it through some online regex checkers. When I run it through Splunk I am not getting my events. I think it is a case issue, how do I make this entire expression case insensitive?
[setnull] REGEX = . DEST_KEY = queue FORMAT = nullQueue
REGEX = updating status for request \d* to \d|jvm appears hung: timed out waiting for signal from jvm DEST_KEY = queue FORMAT = vipp
I think the main issue here is with your "setparsingvipp" transforms.conf stanza. You are sending data to the "vipp" queue, which is not a valid Splunk queue. Do you want this to go to the "parsingQueue" instead?
hazekamp you were correct, need to send to the indexQueue and not the index name, Thanks! I misread how that was to be setup in the documenation.
Here is what is working for me now.
[mcvippapp] TRANSFORMS-mcvipp1=setnull,setmcvipp [pcvippapp] TRANSFORMS-pcvipp1=setnull,setpcvipp
[setnull] REGEX=. DEST_KEY=queue FORMAT=nullQueue [setmcvipp] REGEX=(?m)Updating status for request \d* to (3|4|5)$|JVM appears hung DEST_KEY=queue FORMAT=indexQueue [setpcvipp] REGEX=(?m)Updating status for the request id = \d* from (5|7) to (6|8)$|JVM appears hung DEST_KEY=queue FORMAT=indexQueue
Looks like I needed to use (?m) as well. Have not tried the (?i) yet. Thanks for the help. Hope this helps someone else.