Splunk Search

How to write regex for path in inputs.conf?

anoopambli
Communicator

I need to configure inputs.conf for forwarding a file like below,

G:\BlackBerry Enterprise Server\Logs\20140827\MCLCOVBB61VWIN_MAGT_01_20140827_0001.txt

my inputs.conf looks like this,

[monitor://G:\BlackBerry Enterprise Server\Logs\%Y%m%d\*_MAGT_*_%Y%m%d_*.txt]
disabled = false
followTail = 0
index = coreops
sourcetype = bes_magt

Anything iam doing wrong here, i dont see data coming into splunk, how do i check whether the given regex is parsing out for the right log file?

Tags (2)
1 Solution

kristian_kolb
Ultra Champion

You should probably try something like

[monitor://g:\blackberry enterprise server\logs\*\*MAGT*.txt]

Strptime date variables are not supported in monitor-stanzas.

/K

View solution in original post

kristian_kolb
Ultra Champion

You should probably try something like

[monitor://g:\blackberry enterprise server\logs\*\*MAGT*.txt]

Strptime date variables are not supported in monitor-stanzas.

/K

anoopambli
Communicator

Thank you everyone for responding, above solutions worked for me.

0 Karma

somesoni2
Revered Legend

And you can add whitelist attribute to index files with specific regex.

e.g.

[monitor://g:\blackberry enterprise server\logs\*\*MAGT*.txt]
...
whitelist = *_MAGT_*_\d{8}_*.txt$

anoopambli
Communicator

looks like it is not understanding date variables in the folder path. After running that command, this is what i see in the output,

Monitored Files:
$SPLUNK_HOME\etc\splunk.version
G:\BlackBerry Enterprise Server\Logs\%Y%m%d\

0 Karma

pradeepkumarg
Influencer

On the forwarder, execute splunk list monitor command and see if the expected files are being monitered.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...