Quantcast
Channel: Questions in topic: "splunk-enterprise"
Viewing all articles
Browse latest Browse all 47296

Add two Regexs

$
0
0
Hi, I need to add two RegE to transforms.conf and props.conf If I add one block of code testing each REGEX independently works. If I duplicate the same block of code adding another REGEX it fails. I assume it's related to using the same variables but am uncertain. WORKS: ------ PROPS FILE: (PROPS.CONF): ======================= [source::/path/to/your/access.log*] TRANSFORMS-null= setnull TRANSFORM FILE: (transform.conf): ============================== [setnull] REGEX = \"GET\s\/pictures DEST_KEY = queue FORMAT = nullQueue PROBLEM: -------- PROPS FILE: (PROPS.CONF): ======================= [source::/path/to/your/access.log*] TRANSFORMS-null= setnull TRANSFORM FILE: (transform.conf): ============================== [setnull] REGEX = \"GET\s\/t_static\/clients\/(.*)\/images DEST_KEY = queue FORMAT = nullQueue Thanks,

Viewing all articles
Browse latest Browse all 47296

Trending Articles