Installation

Problem trying to upgrade splunk to 5.0.6 from 5.0 (inputs)

anthonycopus
Path Finder

Hi,

We've recently tried to upgrade our splunk from version 5.0 to 5.0.6 but we received errors in migration relating to our inputs.conf file. For example, here is a configuration we have in inputs:

[monitor://$SPLUNK_HOME/data/shop_purchases]
disabled = false
followTail = 0
index = nexttomo
sourcetype = hk711
whitelist = *.txt

And here's the corresponding error:

12-17-2013 20:23:32.242 +0000 ERROR TailingProcessor - Invalid regular expression: '*.txt' in stanza 'monitor://$SPLUNK_HOME/data/shop_purchases' due to: Regex: nothing to repeat, ignoring this stanza

Does anyone have any idea how we can fix this in order to upgrade successfully?

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

The regex "*" requires a character to repeat. Special "Splunk Regex Foo" for "*" does not apply in this case. Try this:

whitelist = \.txt

anthonycopus
Path Finder

Sorry, initially pasted a non-corresponding stanza.

Yes, this error appears for all the stanzas it seems

0 Karma

lukejadamec
Super Champion

Did you try escaping the .?
whitelist = *\.txt

0 Karma

lukejadamec
Super Champion

The monitor stanzas don't match. Are you getting this error for all monitor stanzas?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...