Splunk Search

How is regex in whitelist of inputs monitor for indexing file to start with special characters?

Explorer

I try to index sybase logs which are located in /sybase/SID/ASE-1(5|6)_0/install/SID.log (SID is variable System-ID)

In Whitelist i only want to monitor files with FL2.log or ACE.log normal regex should be ^[A-Z0-9]{3}.log$

I will use following monitor-stanza on Universal Forwarder:

[monitor:///sybase/*/ASE-1*_0/install/]
whitelist=^[A-Z0-9]{3}\.log$
sourcetype=source_sybase
index=ios_db
_TCP_ROUTING=splunk_main
disabled=false

But then nothing is indexed.

If I use the same stanza without the ^(anchor), then too many files like SID.log or SID_JSAGENT.log are indexed.

[monitor:///sybase/*/ASE-1*_0/install/]
whitelist=[A-Z0-9]{3}\.log$
sourcetype=source_sybase
index=ios_db
_TCP_ROUTING=splunk_main
disabled=false

Does someone have an idea why this is not working or is this a bug in splunk?

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Remember, the regex is matching against ANY PART OF the incoming file name, including the directory. The same regex DOES match those SID_JSAGENT.log files ... the ENT.log part.

Try this...

 whitelist=\/[A-Z0-9]{3}\.log$

updated to escape the slash.

View solution in original post

SplunkTrust
SplunkTrust

Remember, the regex is matching against ANY PART OF the incoming file name, including the directory. The same regex DOES match those SID_JSAGENT.log files ... the ENT.log part.

Try this...

 whitelist=\/[A-Z0-9]{3}\.log$

updated to escape the slash.

View solution in original post

Explorer

Yes that is correct i forgot that is the complete file name with directory. In your answer is only missing the escape before the backslash. Following is working for me:

[monitor:///sybase/*/ASE-1*_0/install/]
whitelist=\/[A-Z0-9]{3}\.log$
sourcetype=source_sybase

Thanks for your answer.

0 Karma

SplunkTrust
SplunkTrust

updated. Please accept the answer so that the question will show complete.

0 Karma