Splunk Search

Regex in Whitelist, in inputs.conf regex help

aa70627
Communicator

I'm trying to monitor log files within my application for the error & fatal logs, which can look like
web-error.log
web-error.log2018-02-01
web-error.log2018-02-02
web-error.log2018-02-02

There's other types of logs in the same directory that follows similar pattern such as web-info.log, web-debug.log, web-warn.log. For now, I'm having issues setting up monitoring just the web.log and all its archived logs.

My inputs.conf is setup with this:
[monitor:////wsbbat/web/dev/logs]
index=web_dev
sourcetype = log4j
source = web_errors
whitelist = web-error.log*
crcSalt =

[monitor:////wsbbat/web/dev/logs]
index=web_dev
sourcetype = log4j
source = web_fatal
whitelist = web-fatal.log*
crcSalt =

I've tried other whitelist pattern such as ones below but none of these patterns seems to work

whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}
whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}$
whitelist = web-error.log$|web.log[0-9-]+
whitelist = web-error.log$|web.log.*

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Just use like this
Fixed typo

[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Just use like this
Fixed typo

[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

aa70627
Communicator

Thanks that worked for me.

0 Karma

aa70627
Communicator

BTW thanks. Trying it out now.

is the second one a typo
[monitor:////wsbbat/web/dev/logs/whitelist = web-fatal.log*]

did you mean
[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

0 Karma

FrankVl
Ultra Champion

Looks like it 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...