Hi All,
I have a Splunk environment with deployment server and forwarders of nearly 200. In one of the deployment apps folders, I have updated the inputs.conf file with the below stanza
[monitor=///opt/.../actimize-logs/CCTM_RETAIL_(NFT|NFOT)_B[13579]/logs/access_logs/]
whitelist=((notify|score)(Customer|PaymentArrangement|Product|Rejection|IntPayment|PassReset|TravelMoney)\.(access.log))$
After deploying the serverclass, I am not able to receive the logs. I have checked the forwarder, but everything is fine and is sending other logs. So I doubt at the inputs stanza only. So can anyone help in identifying the mistake I have done in the regex?
Thanks in advance
... View more