Skip to main content

Hi,

Excuse me for my "not knowing", maybe a easy answer for all of you.

I am in the process of migrating our Heavy Forwaders to Cribl . One off the inputs is for Cisco IOS devices. The props.conf has a Regex in it to change the sourcetype with help of a transforms. The props uses a regex to select the events.

Where and how do i put the regex which is used in the props.conf for filtering the events. Do i have to place this regex in the "filter expresion" in the route? Or in a pre-pipeline? And how do i do it?

Thanks in advance

greetings

Jari

hi Jari,

Most likely you can solve it with the eval function in a pipeline like this:

874_cef8cb8014074615b48d9aef69c9d5a5.png

Of course there are other options as well, so please give me a call if you need more help.

Cheers, Geert.

Thanks Geert, have now put it in a pre-pipeline. Looks good.

greetings

Jari

Reply


Terms & ConditionsCookie settings