Client needs to push these event codes through Heavy Forwarder to Splunk Cloud.
So please help in creating REGEX for filtering the below Event ID's in transforms.conf and props.conf
transforms.conf
1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803
Hi chanamoluk,
The IDs you provided are just samples - a small subset of all the event IDs with the same patterns you want to capture, right?
If so, I think there are two primary patterns: /d{4} and /d{4}-/d{4}.
You can then filter out events with these IDs using the following example stanzas - just for your reference.
props.conf
[EventLog:System]
TRANSFORMS = null_queue_filter
transforms.conf
[null_queue_filter]
REGEX = (?m)^EventID=(/d{4}|/d{4}-/d{4})
DEST_KEY = queue
FORMAT = nullQueue
Hope this helps. Thanks!
Hunter
1100,1101,1102,1104,1105,1108
4624-4627,4634,4646-4668,4670-4672,4675,4690-4691,4698-4702,4704-4707,4709-4720,4722-4735,4737-4794,4797-4803
4817-4820,4865-4900,4902,4904-4908,4911-4913,4928-4937,4944-4952,4954,4956-4958,4964,4976,4985
5031,5063-5070,5120,5136-5145,5148-5159,5168,5376-5377,5440-5444,5446-5453,5456-5468,5471-5474,5477,5632-5633,5888-5889
6144-6145,6272-6280
This are the list of event codes data i want to send to splunk cloud and for which i need regular expressions.
please help me in creating regular expressions... help will appreciated...