Splunk Search

Can you use a regex in serverclass.conf?

stcrispan
Communicator

Trying to filter out a specific type of device type, by host name, in serverclass.conf.

Currently all our tablets are known by SLATEXXXY or SLATEXXXXY, or in some cases, even SLATEXXXYY (where XXX or XXXX represents a location number, and Y or YY represents an iteration of tablet at that location. We are now fielding the next generation of tablets, which will be known by the new convention SLATEXXX-YYY or SLATEXXXX-YYY.

Originally, in serverclass.conf we simply filtered by grabbing all tablets, by using SLATE*. Now we are trying to create a whole new set of indexes and apps for the new devices, which means a new deployment app...but we can't just type SLATE* any more.

So my question is, can I use a regex in serverclass.conf? I have done some independent research and it appears that

^SLATE(\d+\S)-(\S\S\S)

...should work to sort out the right set of parameters to grab all the new tablet names (though I'm damned if i can get it to work in a simple search).

The bottom line is, will it work in serverclass.conf, if I use it as a template to whitelist the new devices?

If not, what would work?

0 Karma

stcrispan
Communicator

So it turn out that NO, you cannot use Regex in the serverclass.conf file, and in fact, you can't use the DOS wildcard expressions either.

So if you have

LAPTOP100-BR549.jr.samples.autosales.com
LAPTOP101A.jr.samples.autosales.com
LAPTOPL42D.Jr.samples.autosales.com 
LAPTOP8701-BR5.jr.samples.autosales.com
LAPTOP549-JSAS.jr.samples.autosales.com

You can't use

[serverClass:JUNIORS_LAPTOPS]
whitelist.0 = ^LAPTOP(\d+\S+\S)-(\S\S\S)$
blacklist.0 = ^LAPTOP(\d+\S)$

You can't even use a

LAPTOP???-???49.jr.samples.autosales.com

To sort out specific, I had to use

LAPTOP*-*.jr.samples.autosales.com

just to get the ones which had a dash in them.

0 Karma

somesoni2
Revered Legend

Per serverclass.conf documentation, the whitelist/blacklist pattern uses wildcard and PCRE regular expressions so I believe something like that should work.

stcrispan
Communicator

Wildcard? You mean like a DOS convention?

When I do a DIR in DOS, I can do a DIR *.exe or DIR *.??e, and get the same file in each listing.

Something like that?

0 Karma

stcrispan
Communicator

Also, is there any way to put a comment in the serverclass.conf file?

0 Karma

somesoni2
Revered Legend

YOu can write comments , start the line with hash #.

somesoni2
Revered Legend

Wildcard * (asterisk) like this

* All of these can be used with wildcards.  * will match any sequence of
  characters.  For example:
    * Match a network range: 10.1.1.*
    * Match a domain: *.splunk.com
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...