Splunk Search

Can you use a regex in serverclass.conf?


Trying to filter out a specific type of device type, by host name, in serverclass.conf.

Currently all our tablets are known by SLATEXXXY or SLATEXXXXY, or in some cases, even SLATEXXXYY (where XXX or XXXX represents a location number, and Y or YY represents an iteration of tablet at that location. We are now fielding the next generation of tablets, which will be known by the new convention SLATEXXX-YYY or SLATEXXXX-YYY.

Originally, in serverclass.conf we simply filtered by grabbing all tablets, by using SLATE*. Now we are trying to create a whole new set of indexes and apps for the new devices, which means a new deployment app...but we can't just type SLATE* any more.

So my question is, can I use a regex in serverclass.conf? I have done some independent research and it appears that


...should work to sort out the right set of parameters to grab all the new tablet names (though I'm damned if i can get it to work in a simple search).

The bottom line is, will it work in serverclass.conf, if I use it as a template to whitelist the new devices?

If not, what would work?

0 Karma


So it turn out that NO, you cannot use Regex in the serverclass.conf file, and in fact, you can't use the DOS wildcard expressions either.

So if you have


You can't use

whitelist.0 = ^LAPTOP(\d+\S+\S)-(\S\S\S)$
blacklist.0 = ^LAPTOP(\d+\S)$

You can't even use a


To sort out specific, I had to use


just to get the ones which had a dash in them.

0 Karma


Per serverclass.conf documentation, the whitelist/blacklist pattern uses wildcard and PCRE regular expressions so I believe something like that should work.


Wildcard? You mean like a DOS convention?

When I do a DIR in DOS, I can do a DIR *.exe or DIR *.??e, and get the same file in each listing.

Something like that?

0 Karma


Also, is there any way to put a comment in the serverclass.conf file?

0 Karma


YOu can write comments , start the line with hash #.


Wildcard * (asterisk) like this

* All of these can be used with wildcards.  * will match any sequence of
  characters.  For example:
    * Match a network range: 10.1.1.*
    * Match a domain: *.splunk.com
0 Karma