Splunk Search

Is it possible to create an input that has a regular expression for digits?



Is it possible to create an input that has a regex on digits? For example, I have a source that begins with /gsysp and I want to monitor anything that has /gsysp followed by digits. So, would /gsysp[0-9]* work on a monitor stanza?

0 Karma

Splunk Employee
Splunk Employee

Take a look at the section titled "Wildcards and regular expression metacharacters" in this section of the documentation: http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Specifyinputpathswithwildcards

According to the docs, "If the regular expression metacharacters occur within or after a segment that contains a wildcard, Splunk Enterprise treats the metacharacters as a regular expression and matches files to monitor accordingly."

By segment, it means the blocks of text between directory separators. So this looks like it would work. The one thing you might need to change is add a + after the [0-9]. Otherwise, it will only look for a single digit and from your question it sounded like it could be more than a single digit.

Splunk Employee
Splunk Employee

Also remember that if your looking for any number, I think \d+ is that character class. Although I don't recall if those are honored in the monitor stanza but still worth knowing to keep it clean.

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...