https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-an-input-that-has-a-regular-expression/m-p/293272#M88532 <P>Also remember that if your looking for any number, I think <CODE>\d+</CODE> is that character class. Although I don't recall if those are honored in the monitor stanza but still worth knowing to keep it clean.</P> Tue, 16 May 2017 12:28:44 GMT sloshburch 2017-05-16T12:28:44Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-an-input-that-has-a-regular-expression/m-p/293270#M88530 <P>Hi,</P> <P>Is it possible to create an input that has a regex on digits? For example, I have a source that begins with /gsysp and I want to monitor anything that has /gsysp followed by digits. So, would <CODE>/gsysp[0-9]*</CODE> work on a monitor stanza?</P> Mon, 15 May 2017 12:54:38 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-an-input-that-has-a-regular-expression/m-p/293270#M88530 a212830 2017-05-15T12:54:38Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-an-input-that-has-a-regular-expression/m-p/293271#M88531 <P>Take a look at the section titled "Wildcards and regular expression metacharacters" in this section of the documentation: <A href="http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Specifyinputpathswithwildcards">http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Specifyinputpathswithwildcards</A></P> <P>According to the docs, "If the regular expression metacharacters occur within or after a segment that contains a wildcard, Splunk Enterprise treats the metacharacters as a regular expression and matches files to monitor accordingly."</P> <P>By segment, it means the blocks of text between directory separators. So this looks like it would work. The one thing you might need to change is add a + after the [0-9]. Otherwise, it will only look for a single digit and from your question it sounded like it could be more than a single digit.</P> Mon, 15 May 2017 13:20:10 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-an-input-that-has-a-regular-expression/m-p/293271#M88531 kmorris_splunk 2017-05-15T13:20:10Z https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-an-input-that-has-a-regular-expression/m-p/293272#M88532 <P>Also remember that if your looking for any number, I think <CODE>\d+</CODE> is that character class. Although I don't recall if those are honored in the monitor stanza but still worth knowing to keep it clean.</P> Tue, 16 May 2017 12:28:44 GMT https://community.splunk.com/t5/Splunk-Search/Is-it-possible-to-create-an-input-that-has-a-regular-expression/m-p/293272#M88532 sloshburch 2017-05-16T12:28:44Z