Getting Data In

whitelist syntax - inputs.conf

nathanlhopkins
Path Finder

I'd like to index files in /DIR/autosys/logs as below;

Linux equivalent:
cd /DIR/autosys/logs
ls app*ua1*START_MT*

Please can someone help me correct below:

[monitor:///DIR/autosys/logs]
whitelist = app\ua1\STOP_MT\$
disabled = false
index = test_index

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

This should work:

[monitor:///DIR/autosys/logs] 
whitelist = app.*ua1.*START_MT.*$
disabled = false 
index = test_index

Also, this should work just as well:

[monitor:///DIR/autosys/logs/app*ua1*START_MT*] 
disabled = false 
index = test_index

Whitelists and blacklists are just regular expressions. The equivalent to a * glob (shell expansion) is ".*". The best way to visualize how whitelists/blacklists work from a unix point of view is

find $STARTDIR -print | egrep "$WHITELIST" | egrep -v "$BLACKLIST"

nathanlhopkins
Path Finder

Many thanks - I didn't really need the whitelist as you pointed out

0 Karma

dwaddle
SplunkTrust
SplunkTrust

easiest way to deal with the markdown formatting is to actually use a code block (4 spaces)

0 Karma

nathanlhopkins
Path Finder

sorry - I didn't realise markdown was removing my *'s - i'm after: ls app*ua1*START_MT*

0 Karma

nathanlhopkins
Path Finder

sorry - something seems to be wrong with pasting into these boxes - i'm after:

ls app*ua1*START_MT*

0 Karma
Get Updates on the Splunk Community!

The Payment Operations Wake-Up Call: Why Financial Institutions Can't Afford ...

The same scenario plays out across financial institutions daily. A payment system fails at 11:30 AM on a busy ...

Make Your Case: A Ready-to-Send Letter for Getting Approval to Attend .conf25

Hello Splunkers, Want to attend .conf25 in Boston this year but not sure how to convince your manager? We've ...

Community Spotlight: A Splunk Expert's Journey

In the world of data analytics, some journeys leave a lasting impact not only on the individual but on the ...