Installation

Problem trying to upgrade splunk to 5.0.6 from 5.0 (inputs)

Path Finder

Hi,

We've recently tried to upgrade our splunk from version 5.0 to 5.0.6 but we received errors in migration relating to our inputs.conf file. For example, here is a configuration we have in inputs:

[monitor://$SPLUNK_HOME/data/shop_purchases]
disabled = false
followTail = 0
index = nexttomo
sourcetype = hk711
whitelist = *.txt

And here's the corresponding error:

12-17-2013 20:23:32.242 +0000 ERROR TailingProcessor - Invalid regular expression: '*.txt' in stanza 'monitor://$SPLUNK_HOME/data/shop_purchases' due to: Regex: nothing to repeat, ignoring this stanza

Does anyone have any idea how we can fix this in order to upgrade successfully?

0 Karma

SplunkTrust
SplunkTrust

The regex "*" requires a character to repeat. Special "Splunk Regex Foo" for "*" does not apply in this case. Try this:

whitelist = \.txt

Path Finder

Sorry, initially pasted a non-corresponding stanza.

Yes, this error appears for all the stanzas it seems

0 Karma

Super Champion

Did you try escaping the .?
whitelist = *\.txt

0 Karma

Super Champion

The monitor stanzas don't match. Are you getting this error for all monitor stanzas?

0 Karma