Quantcast
Channel: Latest Questions on Splunk Answers
Viewing all articles
Browse latest Browse all 13053

Regex for source AND Type

$
0
0

Hi everyone, Been trying to get regex syntax to behave. What I have below works. It only shows events that are from the source "EMET".

props.conf

[WMI:WinEventLog:Application]
TRANSFORMS-wmi=wminull,wmiparse

transforms.conf

[wmiparse]
REGEX=(?m)^SourceName=(EMET)
DEST_KEY=queue
FORMAT=indexQueue

I'm trying to get it to find EMET source events that are also Error logs.

props.conf

[WMI:WinEventLog:Application]
TRANSFORMS-wmi=wminull,wmiparse

transforms.conf

[wmiparse]
REGEX=(?m)^SourceName=(EMET).*^Type=Error
DEST_KEY=queue
FORMAT=indexQueue

But that doesn't seem to work. Any ideas?

Thanks, -S


Viewing all articles
Browse latest Browse all 13053

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>