Splunk Search

regex question...

a212830
Champion

Hi,

I have an inputs.conf that has the following whitelist:

whitelist = (?i)vpxd-\d{5}\.log

The 5 was originally a 4, which relates to a pid number attached to the log. I found out the hard way, that the pid switched from 4 digits to 5 digits. My question is, how can I setup a regex that will handle any number of digits?

Tags (1)
0 Karma

_d_
Splunk Employee
Splunk Employee

Use the + quantifier:

(?i)vpxd-\d+.log

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...