Splunk Search

Regex in Whitelist, in inputs.conf regex help

aa70627
Path Finder

I'm trying to monitor log files within my application for the error & fatal logs, which can look like
web-error.log
web-error.log2018-02-01
web-error.log2018-02-02
web-error.log2018-02-02

There's other types of logs in the same directory that follows similar pattern such as web-info.log, web-debug.log, web-warn.log. For now, I'm having issues setting up monitoring just the web.log and all its archived logs.

My inputs.conf is setup with this:
[monitor:////wsbbat/web/dev/logs]
index=web_dev
sourcetype = log4j
source = web_errors
whitelist = web-error.log*
crcSalt =

[monitor:////wsbbat/web/dev/logs]
index=web_dev
sourcetype = log4j
source = web_fatal
whitelist = web-fatal.log*
crcSalt =

I've tried other whitelist pattern such as ones below but none of these patterns seems to work

whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}
whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}$
whitelist = web-error.log$|web.log[0-9-]+
whitelist = web-error.log$|web.log.*

0 Karma
1 Solution

somesoni2
Revered Legend

Just use like this
Fixed typo

[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

View solution in original post

somesoni2
Revered Legend

Just use like this
Fixed typo

[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

aa70627
Path Finder

Thanks that worked for me.

0 Karma

aa70627
Path Finder

BTW thanks. Trying it out now.

is the second one a typo
[monitor:////wsbbat/web/dev/logs/whitelist = web-fatal.log*]

did you mean
[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

0 Karma

FrankVl
Ultra Champion

Looks like it 🙂

0 Karma
Get Updates on the Splunk Community!

Platform Highlights | November 2022 Newsletter

 November 2022 Skill Up on Splunk with our New Builder Tech Talk SeriesCan you build it? Yes you can! *play ...

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...