Splunk Search

Is it possible to use regex in an inputs.conf monitor stanza?

edrivera3
Builder

Hi

Is it possible to do something like this:

[MONITOR:///some directory/WE\d{8}.log]

for indexing the following filenames:
WE93820493.log
WE37245293.log

I don't want to index the following filename: WE93820493corrupt.log and WE37245293test.log which are indexed with this inputs.conf:

[MONITOR:///some directory/WE*.log]

If it is not possible, is there a way to setup my stanza so I get a similar behavior?
Thanks,

1 Solution

mtranchita
Communicator

I think you can do what you want a number of ways but I would probably try using whitelist or blacklist in the monitor stanza.
I've listed the details on those from the reference the inputs.conf spec.

whitelist =
* If set, files from this input are monitored only if their path matches the specified regex.

blacklist =
* If set, files from this input are NOT monitored if their path matches the specified regex.

View solution in original post

woodcock
Esteemed Legend

The @mtranchita answer is the correct one but if you need to do something beyond RegEx, you can use this approach (but use additional logic):

https://answers.splunk.com/answers/309910/how-to-monitor-a-folder-for-newest-files-only-file.html

0 Karma

mtranchita
Communicator

I think you can do what you want a number of ways but I would probably try using whitelist or blacklist in the monitor stanza.
I've listed the details on those from the reference the inputs.conf spec.

whitelist =
* If set, files from this input are monitored only if their path matches the specified regex.

blacklist =
* If set, files from this input are NOT monitored if their path matches the specified regex.

edrivera3
Builder

I already know to use whitelist and blacklist, the problem is that those files are touched by different users and they don't use a standard way to name them. The only thing that I am sure is that they reserved this formal format: WEXXXXXXXX.log for official use. Thanks anyway for your response.

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Deprecation of Splunk Observability Kubernetes “Classic Navigator” UI starting ...

Access to Splunk Observability Kubernetes “Classic Navigator” UI will no longer be available starting January ...

Now Available: Cisco Talos Threat Intelligence Integrations for Splunk Security Cloud ...

At .conf24, we shared that we were in the process of integrating Cisco Talos threat intelligence into Splunk ...