https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313919#M93955 <P>Just use like this<BR /> <STRONG>Fixed typo</STRONG> </P> <PRE><CODE>[monitor:////wsbbat/web/dev/logs/web-error.log*] index=web_dev sourcetype = log4j source = web_errors [monitor:////wsbbat/web/dev/logs/web-fatal.log*] index=web_dev sourcetype = log4j source = web_fatal </CODE></PRE> Tue, 27 Feb 2018 16:52:34 GMT somesoni2 2018-02-27T16:52:34Z https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313918#M93954 <P>I'm trying to monitor log files within my application for the error &amp; fatal logs, which can look like<BR /> web-error.log<BR /> web-error.log2018-02-01<BR /> web-error.log2018-02-02<BR /> web-error.log2018-02-02</P> <P>There's other types of logs in the same directory that follows similar pattern such as web-info.log, web-debug.log, web-warn.log. For now, I'm having issues setting up monitoring just the web.log and all its archived logs. </P> <P>My inputs.conf is setup with this:<BR /> [monitor:////wsbbat/web/dev/logs]<BR /> index=web_dev<BR /> sourcetype = log4j<BR /> source = web_errors<BR /> whitelist = web-error.log*<BR /> crcSalt = </P> <P>[monitor:////wsbbat/web/dev/logs]<BR /> index=web_dev<BR /> sourcetype = log4j<BR /> source = web_fatal<BR /> whitelist = web-fatal.log*<BR /> crcSalt = </P> <P>I've tried other whitelist pattern such as ones below but none of these patterns seems to work<BR /><BR /> whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}<BR /> whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}$<BR /> whitelist = web-error.log$|web.log[0-9-]+<BR /> whitelist = web-error.log$|web.log.*</P> Tue, 29 Sep 2020 18:12:49 GMT https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313918#M93954 aa70627 2020-09-29T18:12:49Z https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313919#M93955 <P>Just use like this<BR /> <STRONG>Fixed typo</STRONG> </P> <PRE><CODE>[monitor:////wsbbat/web/dev/logs/web-error.log*] index=web_dev sourcetype = log4j source = web_errors [monitor:////wsbbat/web/dev/logs/web-fatal.log*] index=web_dev sourcetype = log4j source = web_fatal </CODE></PRE> Tue, 27 Feb 2018 16:52:34 GMT https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313919#M93955 somesoni2 2018-02-27T16:52:34Z https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313920#M93956 <P>BTW thanks. Trying it out now. </P> <P>is the second one a typo<BR /> [monitor:////wsbbat/web/dev/logs/whitelist = web-fatal.log*]</P> <P>did you mean <BR /> [monitor:////wsbbat/web/dev/logs/web-error.log*]<BR /> index=web_dev<BR /> sourcetype = log4j<BR /> source = web_errors</P> <P>[monitor:////wsbbat/web/dev/logs/web-fatal.log*]<BR /> index=web_dev<BR /> sourcetype = log4j<BR /> source = web_fatal</P> Tue, 29 Sep 2020 18:13:05 GMT https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313920#M93956 aa70627 2020-09-29T18:13:05Z https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313921#M93957 <P>Looks like it <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 27 Feb 2018 17:54:35 GMT https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313921#M93957 FrankVl 2018-02-27T17:54:35Z https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313922#M93958 <P>Thanks that worked for me. </P> Thu, 01 Mar 2018 15:15:48 GMT https://community.splunk.com/t5/Splunk-Search/Regex-in-Whitelist-in-inputs-conf-regex-help/m-p/313922#M93958 aa70627 2018-03-01T15:15:48Z