Does splunk expand the asterisk wildcard in serverclass.conf?

[msarro]

When you define a whitelist or blacklist, suppose you have a set of servers which are differentiated by a character at the end of the FQDN.
So for example a production server:
myserver1-datacenter1-01p.domain.com

And a staging server:
myserver2-datacenter2-02s.domain.com

Is it possible to write the serverClasses as:

[serverClass:staging_servers]
whitelist.0 = myserver*s.domain.com

[serverClass:prod_servers]
whitelist.0 = myserver*p.domain.com

[_d_ · Accepted solution]

Yes, the patterns are PCRE regular expressions, with the following shortcuts:

1. '.' gets translated to '\.'

2. '*' to '.*'

Also, matches are case-insensitive, which means you don't need (?i).

[msarro]

Exactly what I needed to see, thank you!

[adylent]

Yes I believe this to be the case.