topic Does splunk expand the asterisk wildcard in serverclass.conf? in Deployment Architecture

Does splunk expand the asterisk wildcard in serverclass.conf?

msarro — Tue, 22 Oct 2013 20:31:09 GMT

When you define a whitelist or blacklist, suppose you have a set of servers which are differentiated by a character at the end of the FQDN.
So for example a production server:
myserver1-datacenter1-01p.domain.com

And a staging server:
myserver2-datacenter2-02s.domain.com

Is it possible to write the serverClasses as:

[serverClass:staging_servers]
whitelist.0 = myserver*s.domain.com

[serverClass:prod_servers]
whitelist.0 = myserver*p.domain.com

Re: Does splunk expand the asterisk wildcard in serverclass.conf?

adylent — Tue, 22 Oct 2013 20:34:55 GMT

Yes I believe this to be the case.

Re: Does splunk expand the asterisk wildcard in serverclass.conf?

_d_ — Tue, 22 Oct 2013 23:44:27 GMT

Yes, the patterns are PCRE regular expressions, with the following shortcuts:

'.' gets translated to '\.'
'*' to '.*'

Also, matches are case-insensitive, which means you don't need (?i).

Re: Does splunk expand the asterisk wildcard in serverclass.conf?

msarro — Wed, 23 Oct 2013 13:12:37 GMT

Exactly what I needed to see, thank you!