How to write source stanza regex in props.conf for timezone recognition?

[alekksi]

Hi all,

I'm having difficulty trying to get a source stanza to apply the correct timezone to a given number of log files.

To explain, we have a system that logs files in a given folder, but there are a few examples that use UTC instead of BST (UTC+1).
Log files are located in: C:\Apps\logs\{App name}\{Company name}-{App name}-[0].log

Therefore the config looked like this for the inputs.conf:
[monitor://C:\Apps\logs\...]

Trying to set this up for the 'exceptions to the rule' which logs in a different timezone (despite being on the same server...), I end up having quite a few difficulties.

This is an indexer app -- so will be placed in the master-apps section of the cluster master. This is purely for timezone recognition, so any sourcetype assignments are done prior to this. As said earlier, this is for setting exceptions, as it's unlikely that development are going to change the apps (which are very old) to match the accepted standard.

A few scenarios I've tried:

1. The "verbose" approach -- which works, but very messily. This would take 15 stanzas to take into account on a per-app basis what all the exceptions. Example use: [source::C:\Apps\logs\AppName1\*.log]

2. The "monitor" approach -- which doesn't work. This uses the same convention as the monitor stanza in inputs.conf. Example: [source::C:\Apps\logs\...\\CompanyName-(AppName1|AppName2|AppName3)*.log]

3. The "regex" approach -- which also doesn't work. This uses some simple regex to attempt to do the same thing as the above monitor approach. Example: [source::C:\Apps\logs\...\CompanyName-(?:AppName1|AppName2|AppName3).+\.log]

4. The "whitelist" approach -- which definitely doesn't work. This is because it doesn't recognise the whitelist key in the stanza. Example: Invalid key in stanza [source::blahblahblahblah] in /opt/splunk/etc/master-apps/MyAppName/default/props.conf, line 11: whitelist (value:somestuff)

Does any one have any insight into this? It's driving me a bit up the wall!!

Many thanks,
Alex

Edits: Lots of formatting changes

[gkanapathy · Accepted solution]

As it turns out, the syntax used in the props.conf stanza names is a modified PCRE regex. You need:

[source::(?i)c:\\Apps\\logs\\...\\CompanyName-(?:AppName1|AppName2|AppName3)*\.log]

Now, I am basing this regex on what you wrote in scenario 2. This is not the same as the example you give in scenario1.

Basically, it uses PCRE regex with some changes. Basically, if you take ... and replace it with .* and take * and replace it with [^\/\\]* and take . (but not \.) and replace it with \. then that should give you the PCRE regex that's actually used.

[alekksi]

Thank you very much for your response; it has been invaluable in helping with this. I still ended up tearing my hair out quite a bit and settled with the "easiest and simplest" solution:

[source::*(AppName1|AppName2|AppName3)*]

which actually seems to work!!

Edit: Not sure why it's replacing my asterisks with backslashes, but those are asterisks above... star - brackets - name - pipe - name - brackets - star, to put it in English

[gkanapathy]

edited to fix. seems the <code> tags don't work as well as the backtick `for code.