Splunk Search

regex wimp

chowell
Explorer

I have this in a transforms.conf file on one of my forwarders. My goal is to drop everything from either of the IP's, but they keep coming through. What am I doing wrong?

[setnull]
REGEX = .*(10\.3\.0\.(11|12)).*
DEST_KEY = queue
FORMAT = nullQueue

[setparsing]
REGEX = .
DEST_KEY = queue
FORMAT = indexQueue

THanks,

--Carl

Tags (1)

landen99
Motivator

My bet is that your ip exists in the host field and not in the _raw text.

[setnull]
REGEX = 10\.3\.0\.1[12]
SOURCE_KEY=MetaData:Host
DEST_KEY = queue
FORMAT = nullQueue
0 Karma

ftk
Motivator

You don't have to include your wildcards in the front and back. Give it a try as follows:

[setnull]
REGEX = 10\.3\.0\.(11|12)
DEST_KEY = queue
FORMAT = nullQueue

Also make sure that you are actually applying this routing rule to your applicable sourcetype in props.conf....e.g.

[mysourcetype]
TRANSFORMS-setnull = setnull
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...