Getting Data In

Can sourcetype control be applied in props.conf?

rrussellstscied
Explorer

Hopefully a simple question.

I can see that in props.conf you can use source, [source::.../dads_logs/*.log], to control if it's applied but can you use sourcetype:...nameofsourcetype?

Thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

The ... was specific operator to recursively look in a path. Sourcetype is not path so it won't make sense to use ... there. If you're looking to use wildcard in sourcetype name, try something like this

In props.conf

[(?:::){0}*nameofsourcetype*]
0 Karma

rrussellstscied
Explorer

Thanks for the info. I'm not looking for a wildcard but more could I replace in the props file, source:....pathtolog, with [sourcetype:dads_logs], and then the regex, date, and extractions would apply to all logs that come in with a sourcetype of dads_logs?

Sorry - I'm getting dumped into the Splunk world and having some difficulties.

Thanks

0 Karma

somesoni2
SplunkTrust
SplunkTrust

If all the data that belongs to [source::.../dads_logs/*.log] (within Splunk searchindex=* source=*/dads_logs/*.log) a single sourcetype and that sourcetype is only associated with aforementioned source, then you can replace [source::.../dads_logs/*.log] with [yoursourcetype]'

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...