Regex in Whitelist, in inputs.conf... Help!

[mfeeny1]

Hi... Pls forgive me, I have not used Regular Expressions in quite a while, and the following one really threw me. I'm looking for some clarification (enlightenment, maybe??? 🙂 ...

I found the following in inputs.conf on a certain Universal Forwarder:

whitelist = r.log$|t.log$|s_log$

I would have THOUGHT that only the following - very specific - log names would match:

r.log, t.log, s_log

But, I'm told that anything ENDING in these strings will match, e.g.:

avatar.log, long-long-stringt.log, whatever-you-wants_log

Is the second correct? If so, it confuses me that I wouldn't have to precede each regex with something like "dot star" to tell it that any number of characters can precede the "r".

Any clarification will be greatly appreciated!!

mfeeny1

[southeringtonp]

Splunk is trying to match any portion of the string.

The '$' character will match at the end of the string.

Similarly, you can match ("anchor") at the beginning of the string by using '^'.

Remember too that a '.' will match any single character, not just a literal dot, unless you escape it with a slash first.

Try this:

whitelist = (^r\.log$)|(^t\.log$)|(^s\.log$)

[lguinn2]

FWIW, whitelists and blacklists ARE regular expressions. But the monitor stanza itself is NOT!

[monitor://]

is NOT a reg expr & it isn't a normal wild card either! From inputs.conf.spec:

"You can use wildcards to specify your input path for monitored input. Use "..." for recursive directory matching and "*" for wildcard matching in a single directory segment"

I hope I am not confusing here, but I've seen people get bitten when they think that the whitelists, blacklists & the monitor stanza all use the same syntax.

Also see props.conf.spec re: the [source::] stanza