Getting Data In

whitelist syntax - inputs.conf

nathanlhopkins
Path Finder

I'd like to index files in /DIR/autosys/logs as below;

Linux equivalent:
cd /DIR/autosys/logs
ls app*ua1*START_MT*

Please can someone help me correct below:

[monitor:///DIR/autosys/logs]
whitelist = app\ua1\STOP_MT\$
disabled = false
index = test_index

Tags (2)

dwaddle
SplunkTrust
SplunkTrust

This should work:

[monitor:///DIR/autosys/logs] 
whitelist = app.*ua1.*START_MT.*$
disabled = false 
index = test_index

Also, this should work just as well:

[monitor:///DIR/autosys/logs/app*ua1*START_MT*] 
disabled = false 
index = test_index

Whitelists and blacklists are just regular expressions. The equivalent to a * glob (shell expansion) is ".*". The best way to visualize how whitelists/blacklists work from a unix point of view is

find $STARTDIR -print | egrep "$WHITELIST" | egrep -v "$BLACKLIST"

nathanlhopkins
Path Finder

Many thanks - I didn't really need the whitelist as you pointed out

0 Karma

dwaddle
SplunkTrust
SplunkTrust

easiest way to deal with the markdown formatting is to actually use a code block (4 spaces)

0 Karma

nathanlhopkins
Path Finder

sorry - I didn't realise markdown was removing my *'s - i'm after: ls app*ua1*START_MT*

0 Karma

nathanlhopkins
Path Finder

sorry - something seems to be wrong with pasting into these boxes - i'm after:

ls app*ua1*START_MT*

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...