Splunk Search

Can you use a regex in serverclass.conf?

stcrispan
Communicator

Trying to filter out a specific type of device type, by host name, in serverclass.conf.

Currently all our tablets are known by SLATEXXXY or SLATEXXXXY, or in some cases, even SLATEXXXYY (where XXX or XXXX represents a location number, and Y or YY represents an iteration of tablet at that location. We are now fielding the next generation of tablets, which will be known by the new convention SLATEXXX-YYY or SLATEXXXX-YYY.

Originally, in serverclass.conf we simply filtered by grabbing all tablets, by using SLATE*. Now we are trying to create a whole new set of indexes and apps for the new devices, which means a new deployment app...but we can't just type SLATE* any more.

So my question is, can I use a regex in serverclass.conf? I have done some independent research and it appears that

^SLATE(\d+\S)-(\S\S\S)

...should work to sort out the right set of parameters to grab all the new tablet names (though I'm damned if i can get it to work in a simple search).

The bottom line is, will it work in serverclass.conf, if I use it as a template to whitelist the new devices?

If not, what would work?

0 Karma

stcrispan
Communicator

So it turn out that NO, you cannot use Regex in the serverclass.conf file, and in fact, you can't use the DOS wildcard expressions either.

So if you have

LAPTOP100-BR549.jr.samples.autosales.com
LAPTOP101A.jr.samples.autosales.com
LAPTOPL42D.Jr.samples.autosales.com 
LAPTOP8701-BR5.jr.samples.autosales.com
LAPTOP549-JSAS.jr.samples.autosales.com

You can't use

[serverClass:JUNIORS_LAPTOPS]
whitelist.0 = ^LAPTOP(\d+\S+\S)-(\S\S\S)$
blacklist.0 = ^LAPTOP(\d+\S)$

You can't even use a

LAPTOP???-???49.jr.samples.autosales.com

To sort out specific, I had to use

LAPTOP*-*.jr.samples.autosales.com

just to get the ones which had a dash in them.

0 Karma

somesoni2
Revered Legend

Per serverclass.conf documentation, the whitelist/blacklist pattern uses wildcard and PCRE regular expressions so I believe something like that should work.

stcrispan
Communicator

Wildcard? You mean like a DOS convention?

When I do a DIR in DOS, I can do a DIR *.exe or DIR *.??e, and get the same file in each listing.

Something like that?

0 Karma

stcrispan
Communicator

Also, is there any way to put a comment in the serverclass.conf file?

0 Karma

somesoni2
Revered Legend

YOu can write comments , start the line with hash #.

somesoni2
Revered Legend

Wildcard * (asterisk) like this

* All of these can be used with wildcards.  * will match any sequence of
  characters.  For example:
    * Match a network range: 10.1.1.*
    * Match a domain: *.splunk.com
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...