Deployment Architecture

Does splunk expand the asterisk wildcard in serverclass.conf?

msarro
Builder

When you define a whitelist or blacklist, suppose you have a set of servers which are differentiated by a character at the end of the FQDN.
So for example a production server:
myserver1-datacenter1-01p.domain.com

And a staging server:
myserver2-datacenter2-02s.domain.com

Is it possible to write the serverClasses as:

[serverClass:staging_servers]
whitelist.0 = myserver*s.domain.com

[serverClass:prod_servers]
whitelist.0 = myserver*p.domain.com
Tags (1)
0 Karma
1 Solution

_d_
Splunk Employee
Splunk Employee

Yes, the patterns are PCRE regular expressions, with the following shortcuts:

  1. '.' gets translated to '\.'

  2. '*' to '.*'

Also, matches are case-insensitive, which means you don't need (?i).

View solution in original post

_d_
Splunk Employee
Splunk Employee

Yes, the patterns are PCRE regular expressions, with the following shortcuts:

  1. '.' gets translated to '\.'

  2. '*' to '.*'

Also, matches are case-insensitive, which means you don't need (?i).

View solution in original post

msarro
Builder

Exactly what I needed to see, thank you!

0 Karma

adylent
Path Finder

Yes I believe this to be the case.

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.