https://community.splunk.com/t5/Getting-Data-In/regex-question-in-inputs-conf/m-p/145228#M29635 <PRE><CODE>[monitor:///path/to/my/logdir] sourcetype=mysourcetype recursive = false blacklist = (.+#.+\.log)$ </CODE></PRE> Sat, 16 Nov 2013 15:33:19 GMT dmaislin_splunk 2013-11-16T15:33:19Z https://community.splunk.com/t5/Getting-Data-In/regex-question-in-inputs-conf/m-p/145227#M29634 <P>Hi,</P> <P>How would I setup a monitor in inputs.conf that looks for files that begin with "system-" and will process everything (same directory) except files that have a "#" anywhere in them after the "system-" ? </P> <P>I don't want "system-#blahblah.log" or "system-(#junk.log".</P> Sat, 16 Nov 2013 13:37:28 GMT https://community.splunk.com/t5/Getting-Data-In/regex-question-in-inputs-conf/m-p/145227#M29634 a212830 2013-11-16T13:37:28Z https://community.splunk.com/t5/Getting-Data-In/regex-question-in-inputs-conf/m-p/145228#M29635 <PRE><CODE>[monitor:///path/to/my/logdir] sourcetype=mysourcetype recursive = false blacklist = (.+#.+\.log)$ </CODE></PRE> Sat, 16 Nov 2013 15:33:19 GMT https://community.splunk.com/t5/Getting-Data-In/regex-question-in-inputs-conf/m-p/145228#M29635 dmaislin_splunk 2013-11-16T15:33:19Z https://community.splunk.com/t5/Getting-Data-In/regex-question-in-inputs-conf/m-p/145229#M29636 <P>a regex that will identify such strings is:</P> <P>^system-.*#</P> <P>The '^' indicates beginning of line<BR /> The '\' ensure misinterpretation of special character like '-' or '#'<BR /> '.*' means any substring of length 0 or more</P> Sat, 16 Nov 2013 18:45:09 GMT https://community.splunk.com/t5/Getting-Data-In/regex-question-in-inputs-conf/m-p/145229#M29636 peopleware 2013-11-16T18:45:09Z