Getting Data In
×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question

whitelist queries

athorat3
New Member
‎07-03-2017 12:18 AM

HI

I have a question
The existing whitelist in inputs.conf includes

whitelist = (tomcat|vizql|hs_err|tdeserver64)-[^/\\]*\.log$|(tdeserver|tabprotosrv|nativeapi)_vizqlserver.txt

 now there are new files added in the directory

    -a---         6/30/2017  11:58 AM          0 tabprotosrv_backgrounder_0-0.txt
    -a---         6/30/2017  12:03 PM     146491 tabprotosrv_backgrounder_0-0_1.txt
    -a---         6/30/2017  12:04 PM          0 tabprotosrv_backgrounder_0-0_10.txt
    -a---         6/30/2017  12:04 PM          0 tabprotosrv_backgrounder_0-0_11.txt
    -a---         6/30/2017  12:04 PM          0 tabprotosrv_backgrounder_0-0_12.txt
    -a---         6/30/2017  12:06 PM     123767 tabprotosrv_backgrounder_0-0_13.txt


how do I modify the existing whitelist to include these files
IS THE BELOW STANZA CORRECT?
whitelist = (tomcat|vizql|hs_err|tdeserver64)-[^/\\]*\.log$|(tdeserver|tabprotosrv|nativeapi)_vizqlserver.txt$|(tabprotosrv_backgrounder)[\_\d\-]*.txt
Tags (1)
0 Karma
Reply

DalJeanis
Legend
‎07-06-2017 10:48 AM

seems correct, but to be consistent you want a $ anchor after the final .txt, and you want to escape the period when you mean it to be a period (only).

whitelist = (tomcat|vizql|hs_err|tdeserver64)-[^/\\]*\.log$|(tdeserver|tabprotosrv|nativeapi)_vizqlserver\.txt$|(tabprotosrv_backgrounder)[\_\d\-]*\.txt$
0 Karma
Reply

horsefez
Motivator
‎07-03-2017 04:39 AM

Hey,

how about this regular expression.

(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$

Take a look at it here:
https://regex101.com/r/55M6LH/1

Tell me what you think about it.

0 Karma
Reply

athorat3
New Member
‎07-06-2017 09:37 AM

Thanks @horsefez

in the tail processing it says

C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_1_bk.txt

parent C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:.log|.txt)$'.

0 Karma
Reply

athorat3
New Member
‎07-06-2017 09:40 AM 
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_1.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_10_bk.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_10.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_11_bk.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_11.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_12_bk.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_12.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_13_bk.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_13.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_14_bk.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_14.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_15.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_16_bk.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_16.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_17.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_18_bk.txt   
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_18.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_19.txt  
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\tabprotosrv_backgrounder_0-0_2_bk.txt    
parent  C:\ProgramData\Tableau\Tableau Server\data\tabsvc\logs\vizqlserver\
type    File did not match whitelist '(?:^)(?:tomcat|vizql|hs_err|tdeserver|tabprotosrv|nativeapi)(?:.*)(?:\.log|\.txt)$'.
0 Karma
Reply
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Unlocking Unified Insights: New Gigamon Federated Search App for Splunk

In today’s data-heavy environment, organizations are caught in a data distribution dilemma. As data volumes ...

GA: New Data Management App in Splunk Platform

Streamlining Data Management: Introducing a unified experience in Splunk Managing data at scale shouldn’t feel ...

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...