Getting Data In

Splunk Monitoring

siva_cg
Path Finder

Hi.

I have configured two monitor stanzas with whitelist and blacklist attributes to index application logs from an AIS server. The monitor stanzas will look as below:

[monitor:///opt/users/siva/logs/]
whitelist = (ac|bd|eg|fh).access.log$
blacklist = (.\d+|.gz)$
index = main
sourcetype = accesslogs
recursive = true

[monitor:///opt/users/siva/logs/system_logs/]
whitelist = (xyz|uv|pqr).log$
blacklist = (.\d+|.gz)$
index = main
sourcetype = systemlogs
recursive = true

With these configurations, Splunk didn't monitor and index any logs. But when I changed the blacklist attribute value to blacklist = .(gz|\d+) resulted in indexing the logs to Splunk. Even if the regular expression for the blacklist result the same, we didn't get the logs for first one and got the results for the second.

Is there any format or syntax to be used for the blacklist attribute?

Thanks in advance.

0 Karma
1 Solution

lguinn2
Legend

Blacklists and whitelists are unanchored regular expressions. In regular expressions the period (.) is a wild-card representing a single character. If you want to specify the period, it should be "escaped" with a backslash like this example

blacklist=.\d+$

which means "do not index any file whose name ends in a period followed by one or more digits."

View solution in original post

0 Karma

lguinn2
Legend

Blacklists and whitelists are unanchored regular expressions. In regular expressions the period (.) is a wild-card representing a single character. If you want to specify the period, it should be "escaped" with a backslash like this example

blacklist=.\d+$

which means "do not index any file whose name ends in a period followed by one or more digits."

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...

Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...

Financial services organizations face an impossible equation: maintain 99.9% uptime for mission-critical ...

Customer success is front and center at .conf25

Hi Splunkers, If you are not able to be at .conf25 in person, you can still learn about all the latest news ...