Getting Data In

Splunk Monitoring

siva_cg
Path Finder

Hi.

I have configured two monitor stanzas with whitelist and blacklist attributes to index application logs from an AIS server. The monitor stanzas will look as below:

[monitor:///opt/users/siva/logs/]
whitelist = (ac|bd|eg|fh).access.log$
blacklist = (.\d+|.gz)$
index = main
sourcetype = accesslogs
recursive = true

[monitor:///opt/users/siva/logs/system_logs/]
whitelist = (xyz|uv|pqr).log$
blacklist = (.\d+|.gz)$
index = main
sourcetype = systemlogs
recursive = true

With these configurations, Splunk didn't monitor and index any logs. But when I changed the blacklist attribute value to blacklist = .(gz|\d+) resulted in indexing the logs to Splunk. Even if the regular expression for the blacklist result the same, we didn't get the logs for first one and got the results for the second.

Is there any format or syntax to be used for the blacklist attribute?

Thanks in advance.

0 Karma
1 Solution

lguinn2
Legend

Blacklists and whitelists are unanchored regular expressions. In regular expressions the period (.) is a wild-card representing a single character. If you want to specify the period, it should be "escaped" with a backslash like this example

blacklist=.\d+$

which means "do not index any file whose name ends in a period followed by one or more digits."

View solution in original post

0 Karma

lguinn2
Legend

Blacklists and whitelists are unanchored regular expressions. In regular expressions the period (.) is a wild-card representing a single character. If you want to specify the period, it should be "escaped" with a backslash like this example

blacklist=.\d+$

which means "do not index any file whose name ends in a period followed by one or more digits."

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...