Splunk Search

Can you use a regex in serverclass.conf?

Communicator

Trying to filter out a specific type of device type, by host name, in serverclass.conf.

Currently all our tablets are known by SLATEXXXY or SLATEXXXXY, or in some cases, even SLATEXXXYY (where XXX or XXXX represents a location number, and Y or YY represents an iteration of tablet at that location. We are now fielding the next generation of tablets, which will be known by the new convention SLATEXXX-YYY or SLATEXXXX-YYY.

Originally, in serverclass.conf we simply filtered by grabbing all tablets, by using SLATE*. Now we are trying to create a whole new set of indexes and apps for the new devices, which means a new deployment app...but we can't just type SLATE* any more.

So my question is, can I use a regex in serverclass.conf? I have done some independent research and it appears that

^SLATE(\d+\S)-(\S\S\S)

...should work to sort out the right set of parameters to grab all the new tablet names (though I'm damned if i can get it to work in a simple search).

The bottom line is, will it work in serverclass.conf, if I use it as a template to whitelist the new devices?

If not, what would work?

0 Karma

Communicator

So it turn out that NO, you cannot use Regex in the serverclass.conf file, and in fact, you can't use the DOS wildcard expressions either.

So if you have

LAPTOP100-BR549.jr.samples.autosales.com
LAPTOP101A.jr.samples.autosales.com
LAPTOPL42D.Jr.samples.autosales.com 
LAPTOP8701-BR5.jr.samples.autosales.com
LAPTOP549-JSAS.jr.samples.autosales.com

You can't use

[serverClass:JUNIORS_LAPTOPS]
whitelist.0 = ^LAPTOP(\d+\S+\S)-(\S\S\S)$
blacklist.0 = ^LAPTOP(\d+\S)$

You can't even use a

LAPTOP???-???49.jr.samples.autosales.com

To sort out specific, I had to use

LAPTOP*-*.jr.samples.autosales.com

just to get the ones which had a dash in them.

0 Karma

SplunkTrust
SplunkTrust

Per serverclass.conf documentation, the whitelist/blacklist pattern uses wildcard and PCRE regular expressions so I believe something like that should work.

Communicator

Wildcard? You mean like a DOS convention?

When I do a DIR in DOS, I can do a DIR *.exe or DIR *.??e, and get the same file in each listing.

Something like that?

0 Karma

Communicator

Also, is there any way to put a comment in the serverclass.conf file?

0 Karma

SplunkTrust
SplunkTrust

YOu can write comments , start the line with hash #.

SplunkTrust
SplunkTrust

Wildcard * (asterisk) like this

* All of these can be used with wildcards.  * will match any sequence of
  characters.  For example:
    * Match a network range: 10.1.1.*
    * Match a domain: *.splunk.com
0 Karma