Installation

Problem trying to upgrade splunk to 5.0.6 from 5.0 (inputs)

anthonycopus
Path Finder

Hi,

We've recently tried to upgrade our splunk from version 5.0 to 5.0.6 but we received errors in migration relating to our inputs.conf file. For example, here is a configuration we have in inputs:

[monitor://$SPLUNK_HOME/data/shop_purchases]
disabled = false
followTail = 0
index = nexttomo
sourcetype = hk711
whitelist = *.txt

And here's the corresponding error:

12-17-2013 20:23:32.242 +0000 ERROR TailingProcessor - Invalid regular expression: '*.txt' in stanza 'monitor://$SPLUNK_HOME/data/shop_purchases' due to: Regex: nothing to repeat, ignoring this stanza

Does anyone have any idea how we can fix this in order to upgrade successfully?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The regex "*" requires a character to repeat. Special "Splunk Regex Foo" for "*" does not apply in this case. Try this:

whitelist = \.txt

anthonycopus
Path Finder

Sorry, initially pasted a non-corresponding stanza.

Yes, this error appears for all the stanzas it seems

0 Karma

lukejadamec
Super Champion

Did you try escaping the .?
whitelist = *\.txt

0 Karma

lukejadamec
Super Champion

The monitor stanzas don't match. Are you getting this error for all monitor stanzas?

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...