topic Re: correct regex for whitelisting files in Splunk Search

correct regex for whitelisting files

jalfrey — Tue, 29 Oct 2013 20:40:49 GMT

I have files that have names like this:
appflow-0017c569f354.syslog-dynamic-96
appflow-0017c569f354.syslog-dynamic-97
appflow-0017c569f354.syslog-dynamic-102
...

I tried the following regex:

appflow-+[0-9a-z]{12}+.syslog-dynamic-+[0-9]{1,6}

but splunk was not indexing any of the files. What is the correct regex?

Re: correct regex for whitelisting files

kristian_kolb — Tue, 29 Oct 2013 20:49:31 GMT

I would suggest;

appflow-[a-z0-9]{12}\.syslog-dynamic-\d+

which is probably precise enough.

Re: correct regex for whitelisting files

JensT — Wed, 30 Oct 2013 10:36:35 GMT

Hi,

Also an idea:

appflow-[^\.]+\.syslog-dynamic-\d+

-- Jens

Re: correct regex for whitelisting files

jalfrey — Wed, 30 Oct 2013 16:37:38 GMT

Thanks for the speedy response.