Getting Data In

whitelist syntax - inputs.conf

nathanlhopkins
Path Finder

I'd like to index files in /DIR/autosys/logs as below;

Linux equivalent:
cd /DIR/autosys/logs
ls app*ua1*START_MT*

Please can someone help me correct below:

[monitor:///DIR/autosys/logs]
whitelist = app\ua1\STOP_MT\$
disabled = false
index = test_index

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

This should work:

[monitor:///DIR/autosys/logs] 
whitelist = app.*ua1.*START_MT.*$
disabled = false 
index = test_index

Also, this should work just as well:

[monitor:///DIR/autosys/logs/app*ua1*START_MT*] 
disabled = false 
index = test_index

Whitelists and blacklists are just regular expressions. The equivalent to a * glob (shell expansion) is ".*". The best way to visualize how whitelists/blacklists work from a unix point of view is

find $STARTDIR -print | egrep "$WHITELIST" | egrep -v "$BLACKLIST"

nathanlhopkins
Path Finder

Many thanks - I didn't really need the whitelist as you pointed out

0 Karma

dwaddle
SplunkTrust
SplunkTrust

easiest way to deal with the markdown formatting is to actually use a code block (4 spaces)

0 Karma

nathanlhopkins
Path Finder

sorry - I didn't realise markdown was removing my *'s - i'm after: ls app*ua1*START_MT*

0 Karma

nathanlhopkins
Path Finder

sorry - something seems to be wrong with pasting into these boxes - i'm after:

ls app*ua1*START_MT*

0 Karma
Get Updates on the Splunk Community!

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...

Splunk MCP & Agentic AI: Machine Data Without Limits

Discover how the Splunk Model Context Protocol (MCP) Server can revolutionize the way your organization uses ...