Installation

Problem trying to upgrade splunk to 5.0.6 from 5.0 (inputs)

anthonycopus
Path Finder

Hi,

We've recently tried to upgrade our splunk from version 5.0 to 5.0.6 but we received errors in migration relating to our inputs.conf file. For example, here is a configuration we have in inputs:

[monitor://$SPLUNK_HOME/data/shop_purchases]
disabled = false
followTail = 0
index = nexttomo
sourcetype = hk711
whitelist = *.txt

And here's the corresponding error:

12-17-2013 20:23:32.242 +0000 ERROR TailingProcessor - Invalid regular expression: '*.txt' in stanza 'monitor://$SPLUNK_HOME/data/shop_purchases' due to: Regex: nothing to repeat, ignoring this stanza

Does anyone have any idea how we can fix this in order to upgrade successfully?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The regex "*" requires a character to repeat. Special "Splunk Regex Foo" for "*" does not apply in this case. Try this:

whitelist = \.txt

anthonycopus
Path Finder

Sorry, initially pasted a non-corresponding stanza.

Yes, this error appears for all the stanzas it seems

0 Karma

lukejadamec
Super Champion

Did you try escaping the .?
whitelist = *\.txt

0 Karma

lukejadamec
Super Champion

The monitor stanzas don't match. Are you getting this error for all monitor stanzas?

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...