topic Re: In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field? in All Apps and Add-ons

In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field?

odoisneau — Mon, 18 Jul 2016 21:19:25 GMT

We wanted to have diff. log groups for each server in cloudwatch and for each server we would have for ie. secure logstreams. So for example, I would have 3 log groups: testServerA, testServerB,testServerC and under each of those groups, I would have logstream1 with data.

I want to be able to get all the logstream1 data for testServerA/B/C. Can I have an input with log group: testServer* and stream matching regex of logstream1?

Re: In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field?

vsingla1 — Mon, 22 Aug 2016 15:31:04 GMT

I have a similar question too.

I have multiple log groups like:

/aws/sample/Pattern1-random1-random2
/aws/sample/Pattern1-random3-random4
/aws/sample/Pattern1-random5-random6-random7

How do I specify a regular expression in "Log Group" Name that satisfies all these?
I have tried /aws/sample/Pattern1*, /aws/sample/Pattern1[-A-Za-z]+ and a bunch of others.

But I receive this error:

{u'message': u"2 validation errors detected: Value '' at 'logGroupName' failed to satisfy constraint: Member must have length greater than or equal to 1; Value '' at 'logGroupName' failed to satisfy constraint: Member must satisfy regular expression pattern: [\\.\\-_/#A-Za-z0-9]+", u'__type': u'InvalidParameterException'}

Re: In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field?

vsingla1 — Mon, 29 Aug 2016 16:33:55 GMT

Does anyone has any thoughts on this?

Re: In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field?

michael_kushma — Wed, 12 Oct 2016 19:58:48 GMT

I am also having this issue. I have tried * and .+ regex but it won't work. It is requiring the exact log group name.

Re: In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field?

michael_kushma — Wed, 12 Oct 2016 20:00:40 GMT

It doesn't look like there is currently a work around. According to the regex in the error, you can only have digits, letters, ".", "-", "_", and "/". This sound to me like its not using regex to find the log group name.

Re: In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field?

vsingla1 — Wed, 16 Nov 2016 00:25:51 GMT

Hi Michael,
I see the new version of this add-on was released on Oct13 viz. 4.1.1.
Have you upgraded to new version of this add-on? If yes, is the regex working in new version? I do not see any release notes for the new version of add-on, so in a dark here on what was fixed and what not.

https://answers.splunk.com/answers/473926/after-upgrading-the-splunk-add-on-for-amazon-web-s.html

Re: In the Splunk Add-on for Amazon Web Services input page, can I use a wildcard for the log group field?

rpille_splunk — Mon, 21 Nov 2016 23:14:23 GMT

Per the docs, wildcards are not supported at this time for log group names. http://docs.splunk.com/Documentation/AddOns/released/AWS/CloudWatchLogs