0

This question already has an answer here:

Modify or remove any exiting index name to index=secure_np. DIR eg.(_EZAC_pr_linux_w1/local/inputs.conf)

    I try this but not able to modify the index name to index=secure_np

            perl -00lpe '$_.=.*np$"secure_np" 
            if m,/(monitor:///var/log/(?:messages|cron|maillog|secure|audit/audit\.log|maillog)\],' *linux*/local/inputs.conf  

            [monitor:///var/log/messages]
            index=BDBD9D3KMKM_np
            sourcetype=syslog

            [monitor:///var/log/cron]
            index=NDNWCM_np
            sourcetype=syslog

            [monitor:///var/log/maillog]
            index=BSKXB3B_np
            sourcetype=syslog

            [monitor:///var/log/secure]
            index=NDNDKDK0M_np
            sourcetype=syslog

            [monitor:///var/log/spooler]
            index=DNWNDNK8N_np
            sourcetype=syslog

            [monitor:///var/log/audit/audit.log]
            index=XBJBBDHJ_np
            sourcetype=syslog








 Modify or remove any exiting index name eg. index=DHEN_pr to index=secure_pr via DIR eg.(_EZAC_pr_linux_w1/local/inputs.conf)  



       I try this but not able to modify the index name to index=secure_np


            perl -00lpe '$_.=.*pr$"secure_pr" 
            if m,/(monitor:///var/log/(?:messages|cron|maillog|secure|audit/audit\.log|maillog)\],' *linux*/local/inputs.conf


            [monitor:///var/log/messages]
            index=JNJSJ_pr
            sourcetype=syslog

            [monitor:///var/log/cron]
            index=NCJNLN_pr
            sourcetype=syslog

            [monitor:///var/log/maillog]
            index=JE3KKK_pr
            sourcetype=syslog

            [monitor:///var/log/secure]
            index=NLNDKNWL_pr
            sourcetype=syslog

            [monitor:///var/log/spooler]
            index=EKJCDE6D_pr
            sourcetype=syslog

            [monitor:///var/log/audit/audit.log]
            index=QKNKQN9SA_pr 
            sourcetype=syslog

marked as duplicate by roaima, Jeff Schaller Jul 3 at 16:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • Hello. What's the question? What's the problem? What have you tried? What didn't work? What have you done to try and resolve that? Please edit your question to add much more detail. – roaima Jul 2 at 19:12
  • I trying to modify the exiting index name to index=secure_np and index=secure_pr but could`t updated – user10965163 Jul 2 at 20:23
  • The first perl command to modify any index=GKH_np to index=secure_np whiles the second perl command to modify any index=JEKS_pr to index=secure_pr – user10965163 Jul 2 at 20:33