Dashboards & Visualizations

REGEX for the blacklist

damucka
Builder

Hello,

I need help with the REGEX for my blacklist. I have the following file pattern on the source:

indexserver_ls5783.30240.341.trc

but sometimes the end users switch additional traces, which follow the pattern:

indexserver_ls5783.30240_trc115.trc

On the example above, the user activated additional trace with the context name "trc115", which has been appended to the name after underline replacing the tracefile number.
Now, I would like to blacklist these user defined traces.
The starting point for the blacklist regex would be the 5 digits (this is the port number and does not have to be always 30240) + "_" + string + ".trc"
Could you help me with the corresponding blacklist REGEX?

Kind Regards,
Kamil

Tags (1)
0 Karma
1 Solution

harsmarvania57
Ultra Champion

Hi @damucka,

Try this regex for blacklist indexserver_ls\d+\.\d+_\w+\.trc

View solution in original post

0 Karma

harsmarvania57
Ultra Champion

Hi @damucka,

Try this regex for blacklist indexserver_ls\d+\.\d+_\w+\.trc

0 Karma
Get Updates on the Splunk Community!

OpenTelemetry for Legacy Apps? Yes, You Can!

This article is a follow-up to my previous article posted on the OpenTelemetry Blog, "Your Critical Legacy App ...

UCC Framework: Discover Developer Toolkit for Building Technology Add-ons

The Next-Gen Toolkit for Splunk Technology Add-on Development The Universal Configuration Console (UCC) ...

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...