topic Re: How to write regex for path in inputs.conf? in Splunk Search

How to write regex for path in inputs.conf?

anoopambli — Wed, 27 Aug 2014 15:07:53 GMT

I need to configure inputs.conf for forwarding a file like below,

G:\BlackBerry Enterprise Server\Logs\20140827\MCLCOVBB61VWIN_MAGT_01_20140827_0001.txt

my inputs.conf looks like this,

[monitor://G:\BlackBerry Enterprise Server\Logs\%Y%m%d\*_MAGT_*_%Y%m%d_*.txt]
disabled = false
followTail = 0
index = coreops
sourcetype = bes_magt

Anything iam doing wrong here, i dont see data coming into splunk, how do i check whether the given regex is parsing out for the right log file?

pradeepkumarg — Wed, 27 Aug 2014 15:48:16 GMT

On the forwarder, execute splunk list monitor command and see if the expected files are being monitered.

anoopambli — Wed, 27 Aug 2014 16:14:17 GMT

looks like it is not understanding date variables in the folder path. After running that command, this is what i see in the output,

Monitored Files:
$SPLUNK_HOME\etc\splunk.version
G:\BlackBerry Enterprise Server\Logs\%Y%m%d\

kristian_kolb — Wed, 27 Aug 2014 18:33:15 GMT

You should probably try something like

[monitor://g:\blackberry enterprise server\logs\*\*MAGT*.txt]

Strptime date variables are not supported in monitor-stanzas.

somesoni2 — Wed, 27 Aug 2014 20:58:55 GMT

And you can add whitelist attribute to index files with specific regex.

e.g.

[monitor://g:\blackberry enterprise server\logs\*\*MAGT*.txt]
...
whitelist = *_MAGT_*_\d{8}_*.txt$

anoopambli — Fri, 29 Aug 2014 12:32:21 GMT

Thank you everyone for responding, above solutions worked for me.