https://community.splunk.com/t5/Splunk-Search/Props-conf-Regex-question/m-p/36239#M8059 <P>I add this to props.conf to detect shellscripts, but interesting enough this not only matches shell-scripts but also a lot of other files as well, not matching the regex.</P> <P>What am I missing ? </P> <P>[rule::find_shellscript]<BR /> MORE_THAN_0 = ^#!\/bin\/(bash|sh)<BR /> LEARN_MODEL=false<BR /> LEARN_SOURCETYPE=false<BR /> sourcetype=shellscript</P> Mon, 28 Sep 2020 10:13:56 GMT flo_cognosec 2020-09-28T10:13:56Z https://community.splunk.com/t5/Splunk-Search/Props-conf-Regex-question/m-p/36239#M8059 <P>I add this to props.conf to detect shellscripts, but interesting enough this not only matches shell-scripts but also a lot of other files as well, not matching the regex.</P> <P>What am I missing ? </P> <P>[rule::find_shellscript]<BR /> MORE_THAN_0 = ^#!\/bin\/(bash|sh)<BR /> LEARN_MODEL=false<BR /> LEARN_SOURCETYPE=false<BR /> sourcetype=shellscript</P> Mon, 28 Sep 2020 10:13:56 GMT https://community.splunk.com/t5/Splunk-Search/Props-conf-Regex-question/m-p/36239#M8059 flo_cognosec 2020-09-28T10:13:56Z https://community.splunk.com/t5/Splunk-Search/Props-conf-Regex-question/m-p/36240#M8060 <P>Seems like the MORE_THAN / LESS_THAN operators don't actually work as expected , was corrected in the docs already <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Mon, 28 Sep 2020 20:24:57 GMT https://community.splunk.com/t5/Splunk-Search/Props-conf-Regex-question/m-p/36240#M8060 flo_cognosec 2020-09-28T20:24:57Z