Hi... Pls forgive me, I have not used Regular Expressions in quite a while, and the following one really threw me. I'm looking for some clarification (enlightenment, maybe??? 🙂 ...
I found the following in inputs.conf on a certain Universal Forwarder:
whitelist = r.log$|t.log$|s_log$
I would have THOUGHT that only the following - very specific - log names would match:
r.log, t.log, s_log
But, I'm told that anything ENDING in these strings will match, e.g.:
avatar.log, long-long-stringt.log, whatever-you-wants_log
Is the second correct? If so, it confuses me that I wouldn't have to precede each regex with something like "dot star" to tell it that any number of characters can precede the "r".
Any clarification will be greatly appreciated!!
mfeeny1
Splunk is trying to match any portion of the string.
The '$' character will match at the end of the string.
Similarly, you can match ("anchor") at the beginning of the string by using '^'.
Remember too that a '.' will match any single character, not just a literal dot, unless you escape it with a slash first.
Try this:
whitelist = (^r\.log$)|(^t\.log$)|(^s\.log$)
FWIW, whitelists and blacklists ARE regular expressions. But the monitor stanza itself is NOT!
[monitor://
"You can use wildcards to specify your input path for monitored input. Use "..." for recursive directory matching and "*" for wildcard matching in a single directory segment"
I hope I am not confusing here, but I've seen people get bitten when they think that the whitelists, blacklists & the monitor stanza all use the same syntax.
Also see props.conf.spec re: the [source::