Splunk Search

Props.conf / Regex question

Communicator

I add this to props.conf to detect shellscripts, but interesting enough this not only matches shell-scripts but also a lot of other files as well, not matching the regex.

What am I missing ?

[rule::find_shellscript]
MORE_THAN_0 = ^#!\/bin\/(bash|sh)
LEARN_MODEL=false
LEARN_SOURCETYPE=false
sourcetype=shellscript

0 Karma

Communicator

Seems like the MORE_THAN / LESS_THAN operators don't actually work as expected , was corrected in the docs already 😞

0 Karma