Why does our heavy forwarder host_regex configuration work for Linux, but not Windows?

[murikadan]

We are having issues getting Splunk to process log files in windows, The identical configuration works in linux.

Appreciate any help in identifying what the problem could be

This does not work

[batch://E:\DATA\FTP\*.log.gz]
host_regex = E:\DATA\FTP\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false

This works

[batch:///home/ec2-user/temp/*.log.gz]
host_regex = /home/ec2-user/temp/[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz
sourcetype = bluecoat:proxysg:access:file
index = ip-bluecoat
move_policy = sinkhole
disabled = false

Sample log file names:
AB_main_abc123_20151124230023.log
AB_main_2_abc123__2341124210817.log

Splunk version is 6.3

[richgalloway · Accepted solution]

Have you tried escaping your backslashes?

host_regex = E:\\DATA\\FTP\\[A-Z]+_(?:(?:(?:[a-z]+_)|(?:[a-z]+_\d+_)))([a-z]+\d+)_+\d+\.log\.gz

[murikadan]

@richgalloway, Yes tried escaping backslashes, no change.

[ChloeMica]

I have tried but got nothing changed too. Any other ways for that?

[murikadan]

@ChloeMica, If you are defining source explicitly in inputs.conf then splunk uses that string to match not the original filename.
"Detail: This feature examines the source key; if source is set explicitly in the stanza, that string will be matched, not the original filename." - http://docs.splunk.com/Documentation/Splunk/6.3.1/Admin/Inputsconf
Could that be your case ?

[murikadan]

Thanks this solution indeed works!