https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25482#M4154 <P>These are known as anchors. They do not match any characters, they match a position. ^ matches at the start of the string, and $ matches at the end of the string.</P> <P>Be careful though. In multiline strings, they can also match the beginning or end of a line and the ^ inside a square bracket can be used as a not as in [^a-z] which means not the characters a to z</P> Wed, 30 Nov 2011 17:53:21 GMT BobM 2011-11-30T17:53:21Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25481#M4153 <P>I have this in my inputs.conf</P> <P>_whitelist=(\.log|log$|^messages|^secure|mesg$|cron$|acpid$|\.out)</P> <P>Can anyone help me understand what are the " ^ " and the " $ " are used for?</P> Wed, 30 Nov 2011 17:32:04 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25481#M4153 hartfoml 2011-11-30T17:32:04Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25482#M4154 <P>These are known as anchors. They do not match any characters, they match a position. ^ matches at the start of the string, and $ matches at the end of the string.</P> <P>Be careful though. In multiline strings, they can also match the beginning or end of a line and the ^ inside a square bracket can be used as a not as in [^a-z] which means not the characters a to z</P> Wed, 30 Nov 2011 17:53:21 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25482#M4154 BobM 2011-11-30T17:53:21Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25483#M4155 <P>Thanks Bob,</P> <P>I think I know what this is</P> <P>can you tell me what the difference is in these two lines</P> <P>whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)</P> <P>_whitelist=(\.log|log$|^messages|^secure|mesg$|cron$|acpid$|\.out)</P> <P>These are on two different systems and I am not getting the same logs from both</P> <P>Should I take out the " ^ " symbol?</P> Wed, 30 Nov 2011 18:00:18 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25483#M4155 hartfoml 2011-11-30T18:00:18Z https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25484#M4156 <P>Yes the top line will match the words "messages", "secure" or "auth" anywhere in the file or folder name. The bottom will only match if it is at the beginning of the source.</P> <P>As most sources start with the drive or a slash (i.e. c:\ or /), it is unlikely to match those.</P> Wed, 30 Nov 2011 19:58:38 GMT https://community.splunk.com/t5/Getting-Data-In/Inputs-conf/m-p/25484#M4156 BobM 2011-11-30T19:58:38Z