Splunk Search

how can i use a single character wildcard in inputs.conf?

GeorgeStarkey
Path Finder

I have a need to monitor files that look like this:

host one =

/path/to/base/app/App1/App1.{pidnumber}.log
/path/to/base/app/App2/App2.{pidnumber}.log

(yes the digits are there)... however if I monitor:
/path/to/base/app/App*/App*.log

it's too greedy, I end up with the archive version (app rolls it's logs to:

/path/to/base/app/App1.datestamp/App*.{pidnumber}.log
etc.

I think this could work if there was a way to put a singler character wildcard, OR a regex - unfortunatly, since I need the * later sgement, I can't seem to get this to work in regex

monitor:///path/to/base/app/App\d{1}\/App*.log

Tags (3)

lguinn2
Legend

The path specified in monitor is not a regular expression. There is no single character wildcard. But you could do this

[monitor:///path/to/base/app/App*/App*.log]
whitelist = /path/to/base/app/App\d{1}/App.*\.log

Because a whitelist (and the blacklist) are regular expressions.

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...