I need to whitelist files that contain a string in any case and in any place in the filename. And, they can either be .txt or .csv. For example.....any file that contains the string "termite"
termite.txt or termite.csv or TERMite.txt or october_termite_file01.csv
I got "/termite/gmi" from regex 101 but does not seem to work in inputs.conf whitelist.
Thank you for all the suggestions. Here is what I came up with. I ended up needing multiple strings in the whitelist. I realize there are probably other ways but this one works for me.
whitelist = (.*string.*|.*otherstring.*|.*something.*)
Thank you for all the suggestions. Here is what I came up with. I ended up needing multiple strings in the whitelist. I realize there are probably other ways but this one works for me.
whitelist = (.*string.*|.*otherstring.*|.*something.*)
How about this whitelist = (?i)termite
Try <field>=%(?i)[\s\S]*termite[\s\S]*%
It's been a while but as I remember inputs.conf doesn't allow quotation marks when using regexs, or . as a wildcard. The above regex worked for me (minus the (?i) for case, but that should be okay for you) for blacklisting. See:
https://answers.splunk.com/answers/671735/why-is-blacklisting-windows-event-logs-on-a-deploy-1.html