placing conditions in regex

[Jananee_iNautix]

I have the following log format

13-11-22 00:03:06,124 [28c928c9] INFO: file abc.txt-ascii transferred

i want to transform the log into the following format
fri|november |11|2013|abc.txt|(a)

(a) which i mentioned above is the mode of the file either it will be in ascii or binary.if its binary (b) is displayed.

what will be the regex for this pattern in transforms.conf

[alacercogitatus]

Possible, but I'd take a different approach. Firstly, Ayn is also correct. You probably shouldn't do that. But if you really want to:

Transforms.conf

[rewrite_data_sample]
SEDCMD-rewrite = s/(\d+-\d+-\d+\s[^\s]+)\s*\[\w+\]\s*([^:]*):\s*\w+\s*([^-]*)-(\w)\w+\s\w+/\1|\3|\4|\2/g
[extract_data_sample]
REGEX = ([^\|]*)\|([^\|]*)\|([^\|]*)\|([^\|]*)
FORMAT = date_raw::$1 filename::$2 filemode::$3 log_level::$4


Props.conf
[YOUR_SOURCETYPE]
TRANSFORMS-rewrite = rewrite_data_sample
REPORT-newdata = extract_data_sample

[alacercogitatus]

Make sure it is all on one line. Also, check my updated SED CMD.

[Jananee_iNautix]

This is not working.No transformation is done on the logs

[Ayn]

This is in my opinion beyond what you should be doing with basic regexes in Splunk. You should write a script that performs these transformations for you instead, as stuff like converting dates in the way you want are near to impossible to do with just regex. Things like determining the 13th is a Friday in a certain month without having strftime/strptime support would require some insane logic and conditions to get working in a regex.

[Ayn]

No. Read the docs.

[Jananee_iNautix]

To include and execute shell script in splunk,Should splunk be installed in UNIX

[Ayn]

Read the docs!

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Setupcustominputs

[Jananee_iNautix]

can you say me the procedure to include and execute scripts in splunk.Also i have installed splunk in windows os

[Jananee_iNautix]

Thank you Ayn.You said with scripts I can perform transformation.Can you say how to do that in splunk.