Getting Data In

regex question in inputs.conf

a212830
Champion

Hi,

How would I setup a monitor in inputs.conf that looks for files that begin with "system-" and will process everything (same directory) except files that have a "#" anywhere in them after the "system-" ?

I don't want "system-#blahblah.log" or "system-(#junk.log".

Tags (2)
0 Karma

peopleware
New Member

a regex that will identify such strings is:

^system-.*#

The '^' indicates beginning of line
The '\' ensure misinterpretation of special character like '-' or '#'
'.*' means any substring of length 0 or more

0 Karma

dmaislin_splunk
Splunk Employee
Splunk Employee
[monitor:///path/to/my/logdir]
sourcetype=mysourcetype
recursive = false
blacklist = (.+#.+\.log)$
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...