About jblanton_splunk

jblanton_splunk · ‎08-09-2018

You're very welcome! You are correct, you'll have to 'escape' the parenthesis you're needing to match for some of the status responses with a backslash character, for example: REGEX=QRS_MSG_STATUS="(\(ACC\)|\(RECEIVE\)|CANCELLED)"

jblanton_splunk · ‎08-08-2018

Hello rijutha, You'll need to set the quotation marks as part of your Regex capture, and you'll probably want to add the field name as well to prevent it from grabbing other matching strings on accident. Try something like: [abc_defghi_jk_keeptype] REGEX=ABC_MSG_TYPE="(101|102|103|200|202|203)" DEST_KEY = queue FORMAT = indexQueue

Posts	2
Solutions	1
Karma Given	9
Karma Received	0
Member Since	‎08-23-2017

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Re: DBX inputs - Filter Events to NullQueue

Re: DBX inputs - Filter Events to NullQueue