https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279426#M53498 <P>Thank you for your response; it worked out great.</P> Mon, 06 Feb 2017 20:47:11 GMT twmjim 2017-02-06T20:47:11Z https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279423#M53495 <P>Hello,<BR /> I'm trying to pull in a logfile that is named different on each workstation, using a regular expression in the inputs.conf file. </P> <P>The filename is written to each workstation as follows:</P> <P>filename format: </P> <PRE><CODE>` `*logfile* (static text) ` `*computer#* -&gt; three digit number, with leading zeros ` `*.txt* </CODE></PRE> <P>for example:.</P> <PRE><CODE>` `Computer#1 - logfile001.txt ` `Computer#2 - logfile002.txt ` `... ` `Computer #20 - logfile020.txt </CODE></PRE> <P>etc..</P> <P>I attempted to create a regular expression to distribute out to each workstation so that Splunk would read in whatever the filename that is located on the terminal, but the file fails to load.</P> <PRE><CODE>` `**[monitor://C:\logs\logfile0(01|02|03|04|05|06|07|08|09|10|11|12|13|14|15|16|17|18|19|20).txt]** </CODE></PRE> <P>I cannot use a wildcard in the monitor line, such as <CODE>*logfile**.txt*</CODE> because files are rolled over each day with a same filename with the addition of a timestamp (<EM>i.e. logfile01_2017-02-05.txt</EM>) and I don't want to re-read the archived data into the index.</P> <P>Does anyone have a suggestion on what is incorrect with the expression that would cause the file not to be loaded? </P> <P>Any advice would be appreciated. Thank you in advance!</P> Mon, 06 Feb 2017 17:50:36 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279423#M53495 twmjim 2017-02-06T17:50:36Z https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279424#M53496 <P>I would try</P> <PRE><CODE>[monitor://C:\logs\logfile*] whitelist = .*\.txt$ </CODE></PRE> <P>This monitors the directory for files starting with "logfile", but only whitelists files that end with .txt (anchored to end of file name). That should preclude any files that have been rotated by adding a timestamp from being picked up.<BR /> Adjust the whitelist RegEx if you need to ensure the three-digit number is there (add \d{3})</P> Mon, 06 Feb 2017 19:18:18 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279424#M53496 s2_splunk 2017-02-06T19:18:18Z https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279425#M53497 <P>Try like this</P> <PRE><CODE>[monitor://C:\logs\logfile*.txt] index=foo sourcetype=bar whitelist=logfile\d+\.txt$ </CODE></PRE> Mon, 06 Feb 2017 19:20:03 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279425#M53497 somesoni2 2017-02-06T19:20:03Z https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279426#M53498 <P>Thank you for your response; it worked out great.</P> Mon, 06 Feb 2017 20:47:11 GMT https://community.splunk.com/t5/Getting-Data-In/What-is-incorrect-with-my-regular-expression-in-my-inputs-conf/m-p/279426#M53498 twmjim 2017-02-06T20:47:11Z