Splunk Search

Load regex from file

pugnacity
New Member

hi,

currently we use as a central syslog server with logcheck. every hour the server will generate a mail with messages that do not fit to a regex. the same would i do now with splunk and a custom dashboard, but how can i load the regex files into splunk?

Tags (2)
0 Karma

hazekamp
Builder

Would it be possible to add an anonymized sample event(s) to your use case?

0 Karma

vaijpc
Communicator

I get the impression that you would have to do a little more work than 'just' "load the regex files"?

I can't see this being easier than working through the regexes and creating new searches/reports based on them to reimplement the same end report?

Perhaps it would be an idea to take each existing regex and implement an eventtype for it in splunk. Then, run a search/generate a report on messages that don't have the uninteresting (successful) eventtypes?

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...