Splunk Search

Why does our heavy forwarder host_regex configuration work for Linux, but not Windows?

Path Finder

We are having issues getting Splunk to process log files in windows, The identical configuration works in linux.

Appreciate any help in identifying what the problem could be

This does not work

[batch://E:\DATA\FTP\*.log.gz]
host_regex = E:\DATA\FTP\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false

This works

[batch:///home/ec2-user/temp/*.log.gz]
host_regex = /home/ec2-user/temp/[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false

Sample log file names:
ABmainabc12320151124230023.log
AB
main2abc123__2341124210817.log

Splunk version is 6.3

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Have you tried escaping your backslashes?

host_regex = E:\\DATA\\FTP\\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

SplunkTrust
SplunkTrust

Have you tried escaping your backslashes?

host_regex = E:\\DATA\\FTP\\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

Path Finder

@richgalloway, Yes tried escaping backslashes, no change.

0 Karma

New Member

I have tried but got nothing changed too. Any other ways for that?

0 Karma

Path Finder

@ChloeMica, If you are defining source explicitly in inputs.conf then splunk uses that string to match not the original filename.
"Detail: This feature examines the source key; if source is set explicitly in the stanza, that string will be matched, not the original filename." - http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Inputsconf
Could that be your case ?

0 Karma

Path Finder

Thanks this solution indeed works!

0 Karma