0

Inputs files in multiple directories and want to change the exiting index name to index = windows_pr and index = windows_np.

The WinEventLog blocks shown are all in the same file called inputs.conf but reside in different folder name as A. (EVZ_pr_windows/inputs.conf) and B, (DEG_np_windows/inputs.conf). So any file stanza, with indexes ending _pr will be in folder A inputs.conf whilst, any file stanza with indexes ending _np will be in folder B inputs.conf. The script should change indexes ending _pr to index = windows_pr and indexes ending _np to index = windows_np

WinEventLog blocks in inputs.conf is limited to Application, Security, System, ForwardedEvents, and Setup

I try this but getting error

Below is the error

\]_,/s/.*index.*=.*pr$/index = window_pr/' inputs.conf

sed: -e expression #1, char 69: unterminated address regex

#!/bin/bash

sed -E -i '\_\[WinEventLog://(Application|Security|System|ForwardedEvents|Setup)
\]_,/s/.*index.*=.*np$/index = window_np/' inputs.conf

sed -E -i '\_\[WinEventLog://(Application|Security|System|ForwardedEvents|Setup)
\]_,/s/.*index.*=.*pr$/index = window_pr/' inputs.conf


[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = CNDO_pr

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = CGWS_pr

[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = DMRW_pr

[WinEventLog://ForwardedEvents]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = NENP_pr

[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = EOFK_pr

[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = FDWD_np

[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = ASKD_np

[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = JMSF_np

[WinEventLog://ForwardedEvents]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = JCCD_np

[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = HSMS_np
  • 3
    It's not clear at all what you're trying to achieve and how we can help you. – rush Jul 4 at 17:28
  • please clarify your question. I think it should be use instead of used . – Pushpam Kumar Jul 4 at 17:30
  • Please edit your question to include the error that you are getting and an example that causes the error. – David Yockey Jul 5 at 0:18
  • To try to clarify a bit... Are all of the WinEventLog blocks shown supposed to be in the same file called inputs.conf, and are you trying to change all of the indexes ending in _pr (or _np) to window_pr (or window_np)? – David Yockey Jul 6 at 2:10
  • Exactly, the WinEventLog blocks shown are all in the same file called inputs.conf but reside in different folder name as A. (EVZ_pr_windows/inputs.conf) and B, (DEG_np_windows/inputs.conf). So any file stanza, with indexes ending _pr will be in folder A inputs.conf whilst, any file stanza with indexes ending _np will be in folder B inputs.conf. The script should change indexes ending _pr to index = windows_pr and indexes ending _np to index = windows_np – user10965163 Jul 6 at 8:20
0

Considering the error message and assuming that expression #1 begins with \\_, char 69 of that expression appears to be _ immediately following ]. Consequently, I'd guess that you need a \ preceeding that _ to provide a proper terminator for the expression.

  • Still could`t resolve the error issues – user10965163 Jul 5 at 19:30
  • Is it still the same error? – David Yockey Jul 5 at 23:29
  • right same error – user10965163 Jul 6 at 7:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.