Is it possible to create an input that has a regular expression for digits?

[a212830]

Hi,

Is it possible to create an input that has a regex on digits? For example, I have a source that begins with /gsysp and I want to monitor anything that has /gsysp followed by digits. So, would /gsysp[0-9]* work on a monitor stanza?

[kmorris_splunk]

Take a look at the section titled "Wildcards and regular expression metacharacters" in this section of the documentation: http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Specifyinputpathswithwildcards

According to the docs, "If the regular expression metacharacters occur within or after a segment that contains a wildcard, Splunk Enterprise treats the metacharacters as a regular expression and matches files to monitor accordingly."

By segment, it means the blocks of text between directory separators. So this looks like it would work. The one thing you might need to change is add a + after the [0-9]. Otherwise, it will only look for a single digit and from your question it sounded like it could be more than a single digit.

[sloshburch]

Also remember that if your looking for any number, I think \d+ is that character class. Although I don't recall if those are honored in the monitor stanza but still worth knowing to keep it clean.