0

This question already has an answer here:

The exiting index, has been name as 

index=_np and index=_pr on each stanzas. Base on that, the script has modify the exiting index name to index=secure_np and index=secure_pr

Below is the example.

I try this but not able to modify the index name to index=secure_np

                perl -00lpe '$_.=.*np$"secure_np" 
                if m,/(monitor:///var/log/(?:messages|cron|maillog|secure|audit/audit\.log|maillog)\],' inputs.conf  

                [monitor:///var/log/messages]
                index=BDBD9D3KMKM_np
                sourcetype=syslog

                [monitor:///var/log/cron]
                index=NDNWCM_np
                sourcetype=syslog

                [monitor:///var/log/maillog]
                index=BSKXB3B_np
                sourcetype=syslog

                [monitor:///var/log/secure]
                index=NDNDKDK0M_np
                sourcetype=syslog

                [monitor:///var/log/spooler]
                index=DNWNDNK8N_np
                sourcetype=syslog

                [monitor:///var/log/audit/audit.log]
                index=XBJBBDHJ_np
                sourcetype=syslog







    Remove any exiting index name and update to index=secure_np. DIR loc
 (_EZAC_pr_linux_w1/local/inputs.conf)


           I try this but not able to Remove any exiting index name and update 

                perl -00lpe '$_.=.*pr$"secure_pr" 
                if m,/(monitor:///var/log/(?:messages|cron|maillog|secure|audit/audit\.log|maillog)\],' inputs.conf


                [monitor:///var/log/messages]
                index=JNJSJ_pr
                sourcetype=syslog

                [monitor:///var/log/cron]
                index=NCJNLN_pr
                sourcetype=syslog

                [monitor:///var/log/maillog]
                index=JE3KKK_pr
                sourcetype=syslog

                [monitor:///var/log/secure]
                index=NLNDKNWL_pr
                sourcetype=syslog

                [monitor:///var/log/spooler]
                index=EKJCDE6D_pr
                sourcetype=syslog

                [monitor:///var/log/audit/audit.log]
                index=QKNKQN9SA_pr 
                sourcetype=syslog

marked as duplicate by Jeff Schaller Jul 3 at 16:30

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • You've asked the same question five times now. Please edit your original question with the output from the attempted answers there so that you can finally get a good answer. Thank you! – Jeff Schaller Jul 3 at 16:30
  • Please edit your original question instead of this one, so that we can build from the history you have there. Thank you! – Jeff Schaller Jul 3 at 17:42
  • Previous 2 solution does not solve the problem – user10965163 Jul 4 at 16:02
  • The previous solution provided, does not solve the problem it supposed to remove the exiting index and update it with new index provided but rather it just added to the exiting index name eg. index=abc , index=abcsecure , instead of index=secure – user10965163 Jul 4 at 16:12