Getting Data In

In inputs.conf whitelist, how do I create a regex expression for whitelisting files which contain a certain string?

coreyf311
Path Finder

I need to whitelist files that contain a string in any case and in any place in the filename. And, they can either be .txt or .csv. For example.....any file that contains the string "termite"

termite.txt or termite.csv or TERMite.txt or october_termite_file01.csv

I got "/termite/gmi" from regex 101 but does not seem to work in inputs.conf whitelist.

0 Karma
1 Solution

coreyf311
Path Finder

Thank you for all the suggestions. Here is what I came up with. I ended up needing multiple strings in the whitelist. I realize there are probably other ways but this one works for me.

whitelist = (.*string.*|.*otherstring.*|.*something.*)

View solution in original post

0 Karma

coreyf311
Path Finder

Thank you for all the suggestions. Here is what I came up with. I ended up needing multiple strings in the whitelist. I realize there are probably other ways but this one works for me.

whitelist = (.*string.*|.*otherstring.*|.*something.*)

0 Karma

sudosplunk
Motivator

How about this whitelist = (?i)termite

0 Karma

nick405060
Motivator

Try <field>=%(?i)[\s\S]*termite[\s\S]*%

It's been a while but as I remember inputs.conf doesn't allow quotation marks when using regexs, or . as a wildcard. The above regex worked for me (minus the (?i) for case, but that should be okay for you) for blacklisting. See:

https://answers.splunk.com/answers/671735/why-is-blacklisting-windows-event-logs-on-a-deploy-1.html

0 Karma