Getting Data In

whitelist syntax - inputs.conf

nathanlhopkins
Path Finder

I'd like to index files in /DIR/autosys/logs as below;

Linux equivalent:
cd /DIR/autosys/logs
ls app*ua1*START_MT*

Please can someone help me correct below:

[monitor:///DIR/autosys/logs]
whitelist = app\ua1\STOP_MT\$
disabled = false
index = test_index

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

This should work:

[monitor:///DIR/autosys/logs] 
whitelist = app.*ua1.*START_MT.*$
disabled = false 
index = test_index

Also, this should work just as well:

[monitor:///DIR/autosys/logs/app*ua1*START_MT*] 
disabled = false 
index = test_index

Whitelists and blacklists are just regular expressions. The equivalent to a * glob (shell expansion) is ".*". The best way to visualize how whitelists/blacklists work from a unix point of view is

find $STARTDIR -print | egrep "$WHITELIST" | egrep -v "$BLACKLIST"

nathanlhopkins
Path Finder

Many thanks - I didn't really need the whitelist as you pointed out

0 Karma

dwaddle
SplunkTrust
SplunkTrust

easiest way to deal with the markdown formatting is to actually use a code block (4 spaces)

0 Karma

nathanlhopkins
Path Finder

sorry - I didn't realise markdown was removing my *'s - i'm after: ls app*ua1*START_MT*

0 Karma

nathanlhopkins
Path Finder

sorry - something seems to be wrong with pasting into these boxes - i'm after:

ls app*ua1*START_MT*

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...