topic Monitor Whitelist File extensions in Getting Data In

Monitor Whitelist File extensions

SplunkUser5888 — Fri, 16 Nov 2012 09:14:07 GMT

Hey guys, I guess this is a simple question but all the answers I look at seem very complicated for what I want.
I want splunk to do a monitor on C:\Program Files on extensions *.exe, *.com, *.scr and *.dll

But when I try

[monitor://C:\Program Files]
sourcetype = fileExtensions
whitelist = *.exe, *.dll, *.scr, *.com

I get ALL the files in Program Files appearing in the Splunk search.

I guess I am doing whitelisting wrong, any help?

Re: Monitor Whitelist File extensions

Mathieu_Dessus — Fri, 16 Nov 2012 16:31:33 GMT

Hi M-A 🙂

whitelist and blacklist are not a list of values, but a regular expression.
Have a look at the bottom of this page: http://docs.splunk.com/Documentation/Splunk/5.0/data/Specifyinputpathswithwildcards

Re: Monitor Whitelist File extensions

SplunkUser5888 — Mon, 19 Nov 2012 08:41:19 GMT

Salut, thanks, I couldn't find that document