Splunk Search

Is it possible to create an input that has a regular expression for digits?

a212830
Champion

Hi,

Is it possible to create an input that has a regex on digits? For example, I have a source that begins with /gsysp and I want to monitor anything that has /gsysp followed by digits. So, would /gsysp[0-9]* work on a monitor stanza?

0 Karma

kmorris_splunk
Splunk Employee
Splunk Employee

Take a look at the section titled "Wildcards and regular expression metacharacters" in this section of the documentation: http://docs.splunk.com/Documentation/Splunk/6.6.0/Data/Specifyinputpathswithwildcards

According to the docs, "If the regular expression metacharacters occur within or after a segment that contains a wildcard, Splunk Enterprise treats the metacharacters as a regular expression and matches files to monitor accordingly."

By segment, it means the blocks of text between directory separators. So this looks like it would work. The one thing you might need to change is add a + after the [0-9]. Otherwise, it will only look for a single digit and from your question it sounded like it could be more than a single digit.

sloshburch
Splunk Employee
Splunk Employee

Also remember that if your looking for any number, I think \d+ is that character class. Although I don't recall if those are honored in the monitor stanza but still worth knowing to keep it clean.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...