Inputs files in multiple directories and want to change the exiting index name to index = windows_pr and index = windows_np.
The WinEventLog blocks shown are all in the same file called inputs.conf but reside in different folder name as A. (EVZ_pr_windows/inputs.conf) and B, (DEG_np_windows/inputs.conf). So any file stanza, with indexes ending _pr will be in folder A inputs.conf whilst, any file stanza with indexes ending _np will be in folder B inputs.conf. The script should change indexes ending _pr to index = windows_pr and indexes ending _np to index = windows_np
WinEventLog blocks in inputs.conf is limited to Application, Security, System, ForwardedEvents, and Setup
I try this but getting error
Below is the error
\]_,/s/.*index.*=.*pr$/index = window_pr/' inputs.conf
sed: -e expression #1, char 69: unterminated address regex
#!/bin/bash
sed -E -i '\_\[WinEventLog://(Application|Security|System|ForwardedEvents|Setup)
\]_,/s/.*index.*=.*np$/index = window_np/' inputs.conf
sed -E -i '\_\[WinEventLog://(Application|Security|System|ForwardedEvents|Setup)
\]_,/s/.*index.*=.*pr$/index = window_pr/' inputs.conf
[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = CNDO_pr
[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = CGWS_pr
[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = DMRW_pr
[WinEventLog://ForwardedEvents]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = NENP_pr
[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = EOFK_pr
[WinEventLog://Application]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = FDWD_np
[WinEventLog://Security]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = ASKD_np
[WinEventLog://System]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = JMSF_np
[WinEventLog://ForwardedEvents]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = JCCD_np
[WinEventLog://Setup]
checkpointInterval = 5
current_only = 0
disabled =0
start_from = oldest
index = HSMS_np
use
instead ofused
. – Pushpam Kumar Jul 4 at 17:30WinEventLog
blocks shown supposed to be in the same file calledinputs.conf
, and are you trying to change all of the indexes ending in_pr
(or_np
) towindow_pr
(orwindow_np
)? – David Yockey Jul 6 at 2:10