Splunk Search

Regex in Whitelist, in inputs.conf regex help

aa70627
Communicator

I'm trying to monitor log files within my application for the error & fatal logs, which can look like
web-error.log
web-error.log2018-02-01
web-error.log2018-02-02
web-error.log2018-02-02

There's other types of logs in the same directory that follows similar pattern such as web-info.log, web-debug.log, web-warn.log. For now, I'm having issues setting up monitoring just the web.log and all its archived logs.

My inputs.conf is setup with this:
[monitor:////wsbbat/web/dev/logs]
index=web_dev
sourcetype = log4j
source = web_errors
whitelist = web-error.log*
crcSalt =

[monitor:////wsbbat/web/dev/logs]
index=web_dev
sourcetype = log4j
source = web_fatal
whitelist = web-fatal.log*
crcSalt =

I've tried other whitelist pattern such as ones below but none of these patterns seems to work

whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}
whitelist = web-error.log$|web.log\d{4}-\d{2}-\d{2}$
whitelist = web-error.log$|web.log[0-9-]+
whitelist = web-error.log$|web.log.*

0 Karma
1 Solution

somesoni2
Revered Legend

Just use like this
Fixed typo

[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

View solution in original post

somesoni2
Revered Legend

Just use like this
Fixed typo

[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

aa70627
Communicator

Thanks that worked for me.

0 Karma

aa70627
Communicator

BTW thanks. Trying it out now.

is the second one a typo
[monitor:////wsbbat/web/dev/logs/whitelist = web-fatal.log*]

did you mean
[monitor:////wsbbat/web/dev/logs/web-error.log*]
index=web_dev
sourcetype = log4j
source = web_errors

[monitor:////wsbbat/web/dev/logs/web-fatal.log*]
index=web_dev
sourcetype = log4j
source = web_fatal

0 Karma

FrankVl
Ultra Champion

Looks like it 🙂

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...