Splunk Search

How to disable serverclass aids

trs01
New Member

In the serverclass spec link:serverclass.spec , Is there a way to disable these "helpful" regex aids? I'm already pretty good at regex and these "aids" are breaking valid pcre regexes.

 * These patterns are PCRE regular expressions, with the following aids for
   easier entry:
     * You can specify simply '.' to mean '\.'
     * You can specify simply '*' to mean '.*'
 * Matches are always case-insensitive; you do not need to specify the '(?i)' prefix.

Example:

hosts
cu-idp-p-idp04.domain.com
cu-idp31-d-tst03.domain.com

This regex
whitelist.0 = cu-idp\d*-[pcrzd]-(idp|tst)\d+.*

had to be changed to
whitelist.0 = cu-idp\d{0,}-[pcrzd]-(idp|tst)\d+*

even though the first one is valid PCRE.

https://regex101.com/r/E07teW/1

Also, little help with the serverclass link mods? It looks like I don't have enough rep to create a link

0 Karma
Get Updates on the Splunk Community!

Index This | What goes up and never comes down?

January 2026 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Splunkers, Pack Your Bags: Why Cisco Live EMEA is Your Next Big Destination

The Power of Two: Splunk + Cisco at "Ludicrous Scale"   You know Splunk. You know Cisco. But have you seen ...

Data Management Digest – January 2026

Welcome to the January 2026 edition of Data Management Digest! Welcome to the January 2026 edition of Data ...