Splunk Search

regex question...

a212830
Champion

Hi,

I have an inputs.conf that has the following whitelist:

whitelist = (?i)vpxd-\d{5}\.log

The 5 was originally a 4, which relates to a pid number attached to the log. I found out the hard way, that the pid switched from 4 digits to 5 digits. My question is, how can I setup a regex that will handle any number of digits?

Tags (1)
0 Karma

_d_
Splunk Employee
Splunk Employee

Use the + quantifier:

(?i)vpxd-\d+.log

Get Updates on the Splunk Community!

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...