Getting Data In

Multiple Whitelists

robertlynch2020
Motivator

Hi

I have the following two inputs in inputs.conf. They both work separably but not together.

**Working**
[monitor:///net/dell428srv/data2/apps/mx_ox62148_191418/logs_latest_17052017-064938.../*.log]
disabled = false
host = MXTIMING_TEST1_DELL428SRV
index = mlc_live
whitelist =  mxtiming_(?<FULL_STRING>\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

**Working**
[monitor:///net/dell428srv/data2/apps/mx_ox62148_191418/logs_latest_17052017-064938.../*.log]
disabled = false
host = MXTIMING_TEST1_DELL428SRV
index = mlc_live
whitelist =  mxtiming_(?<FULL_STRING>[^_]*_[^_]*_\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

When i try to add them together with a | nothing works, i have a few to add so i don't want to have to keep copying this code

    **NOT_WORKING**
    [monitor:///net/dell428srv/data2/apps/mx_ox62148_191418/logs_latest_17052017-064938.../*.log]
    disabled = false
    host = MXTIMING_TEST1_DELL428SRV
    index = mlc_live
    whitelist =  mxtiming_(?<FULL_STRING>\d*_[^_]*_\d*)\.log|mxtiming_(?<FULL_STRING>[^_]*_[^_]*_\d*_[^_]*_\d*)\.log
crcSalt = <SOURCE>
sourcetype = MX_TIMING

Any ideas would be great 🙂

0 Karma
1 Solution

cpetterborg
SplunkTrust
SplunkTrust

Two things. First, your regex is invalid, you define FULL_STRING twice, which is not allowed in a regex. Since you aren't using a named capture group later, just get rid of it.

Second, parenthesis will be your friend. Try:

whitelist =  (mxtiming_(\d*_[^_]*_\d*)\.log)|(mxtiming_([^_]*_[^_]*_\d*_[^_]*_\d*)\.log))

But, you can't make it better:

whitelist = mxtiming_((\d*_[^_]*_\d)|([^_]*_[^_]*_\d*_[^_]*_\d*))\.log

I'm not sure why you don't just use:

whitelist = mxtiming_.*\.log

Which should work just as well, if you don't have a third name that uses mxtiming_*.log.

View solution in original post

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

Two things. First, your regex is invalid, you define FULL_STRING twice, which is not allowed in a regex. Since you aren't using a named capture group later, just get rid of it.

Second, parenthesis will be your friend. Try:

whitelist =  (mxtiming_(\d*_[^_]*_\d*)\.log)|(mxtiming_([^_]*_[^_]*_\d*_[^_]*_\d*)\.log))

But, you can't make it better:

whitelist = mxtiming_((\d*_[^_]*_\d)|([^_]*_[^_]*_\d*_[^_]*_\d*))\.log

I'm not sure why you don't just use:

whitelist = mxtiming_.*\.log

Which should work just as well, if you don't have a third name that uses mxtiming_*.log.

0 Karma

robertlynch2020
Motivator

Thanks very much. In fact i went for the last option.

Cheers

0 Karma

cpetterborg
SplunkTrust
SplunkTrust

It is the easiest and will match other file names if they happen to change any in the future. I find it best to do that simplest version whenever possible. 🙂

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...