https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293748#M92829 <P>Thanks <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/109956">@horsefez</a></P> <P>in the tail processing it says</P> <P>C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_1_bk.txt </P> <P>parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\<BR /> type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:.log|.txt)$'.</P> Tue, 29 Sep 2020 14:46:17 GMT athorat3 2020-09-29T14:46:17Z https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293746#M92827 <P>HI</P> <P>I have a question<BR /> The existing whitelist in inputs.conf includes</P> <PRE><CODE>whitelist = (tomcat|vizql|hs_err|tdeserver64)-[^/\\]*\.log$|(tdeserver|tabprotosrv|nativeapi)_vizqlserver.txt now there are new files added in the directory -a---         6/30/2017  11:58 AM          0 tabprotosrv_backgrounder_0-0.txt -a---         6/30/2017  12:03 PM     146491 tabprotosrv_backgrounder_0-0_1.txt -a---         6/30/2017  12:04 PM          0 tabprotosrv_backgrounder_0-0_10.txt -a---         6/30/2017  12:04 PM          0 tabprotosrv_backgrounder_0-0_11.txt -a---         6/30/2017  12:04 PM          0 tabprotosrv_backgrounder_0-0_12.txt -a---         6/30/2017  12:06 PM     123767 tabprotosrv_backgrounder_0-0_13.txt how do I modify the existing whitelist to include these files IS THE BELOW STANZA CORRECT? whitelist = (tomcat|vizql|hs_err|tdeserver64)-[^/\\]*\.log$|(tdeserver|tabprotosrv|nativeapi)_vizqlserver.txt$|(tabprotosrv_backgrounder)[\_\d\-]*.txt </CODE></PRE> Mon, 03 Jul 2017 07:18:38 GMT https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293746#M92827 athorat3 2017-07-03T07:18:38Z https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293747#M92828 <P>Hey, </P> <P>how about this regular expression.</P> <P><CODE>(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$</CODE></P> <P>Take a look at it here:<BR /> <A href="https://regex101.com/r/55M6LH/1">https://regex101.com/r/55M6LH/1</A></P> <P>Tell me what you think about it.</P> Mon, 03 Jul 2017 11:39:13 GMT https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293747#M92828 horsefez 2017-07-03T11:39:13Z https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293748#M92829 <P>Thanks <a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/109956">@horsefez</a></P> <P>in the tail processing it says</P> <P>C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_1_bk.txt </P> <P>parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\<BR /> type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:.log|.txt)$'.</P> Tue, 29 Sep 2020 14:46:17 GMT https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293748#M92829 athorat3 2020-09-29T14:46:17Z https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293749#M92830 <PRE><CODE>C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_1.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_10_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_10.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_11_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_11.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_12_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_12.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_13_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_13.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_14_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_14.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_15.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_16_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_16.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_17.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_18_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_18.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_19.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_2_bk.txt parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\ type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'. </CODE></PRE> Thu, 06 Jul 2017 16:40:34 GMT https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293749#M92830 athorat3 2017-07-06T16:40:34Z https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293750#M92831 <P>seems correct, but to be consistent you want a $ anchor after the final .txt, and you want to escape the period when you mean it to be a period (only).</P> <PRE><CODE>whitelist = (tomcat|vizql|hs_err|tdeserver64)-[^/\\]*\.log$|(tdeserver|tabprotosrv|nativeapi)_vizqlserver\.txt$|(tabprotosrv_backgrounder)[\_\d\-]*\.txt$ </CODE></PRE> Thu, 06 Jul 2017 17:48:18 GMT https://community.splunk.com/t5/Getting-Data-In/whitelist-queries/m-p/293750#M92831 DalJeanis 2017-07-06T17:48:18Z