Splunk Monitoring

[siva_cg]

Hi.

I have configured two monitor stanzas with whitelist and blacklist attributes to index application logs from an AIS server. The monitor stanzas will look as below:

[monitor:///opt/users/siva/logs/]
whitelist = (ac|bd|eg|fh).access.log$
blacklist = (.\d+|.gz)$
index = main
sourcetype = accesslogs
recursive = true

[monitor:///opt/users/siva/logs/system_logs/]
whitelist = (xyz|uv|pqr).log$
blacklist = (.\d+|.gz)$
index = main
sourcetype = systemlogs
recursive = true

With these configurations, Splunk didn't monitor and index any logs. But when I changed the blacklist attribute value to blacklist = .(gz|\d+) resulted in indexing the logs to Splunk. Even if the regular expression for the blacklist result the same, we didn't get the logs for first one and got the results for the second.

Is there any format or syntax to be used for the blacklist attribute?

Thanks in advance.

[lguinn2 · Accepted solution]

Blacklists and whitelists are unanchored regular expressions. In regular expressions the period (.) is a wild-card representing a single character. If you want to specify the period, it should be "escaped" with a backslash like this example

blacklist=.\d+$

which means "do not index any file whose name ends in a period followed by one or more digits."