Why is my input not getting parsed if I use wildcards?

[ankithreddy777]

Hi

I have a input with sourcetype [eventlog].

In props.conf If I use sourcetype as below to define settings it is working.
[eventlog]
...

But if I use wildcards as below my input is not getting parsed according to the configurations defined under below stanza.
[eventlog*]
...
...

May I know if there is any reason?

[ddrillic]

@ankithreddy777 - keep please in mind that even though it's not officially supported, it works well for us. Something like -

[(?::){0}*<sourcetype tail name>]

Please refer to the following link in which @somesoni2 explained it - How can we apply TRUNCATE across many sourcetypes?

[MuS]

Add see here https://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-sta... @jrodman 's comment from 2012 why you should not rely on it ...

[ankithreddy777]

Hi @ddrillic - Using wildcards in sourcetype like above follow stanza precedence in ASCII priority?.

[ddrillic]

I see @MuS - so, why isn't it a feature after years where people keep asking and needing this feature, that makes clusters of sourcetypes handled uniformly?

[MuS]

I don't know ¯\_(ツ)_/¯ you can log an enhancement request for it if you like 😉

[ddrillic]

I will sure do that @MuS - I love this hidden powerful capability.

[MuS · Accepted solution]

Hi ankithreddy777,

there is no official and supported wildcard matching on sourcetype, see the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf

**[source::<source>] and [host::<host>] stanza match language:**

Match expressions must match the entire name, not just a substring. If you
are familiar with regular expressions, match expressions are based on a full
implementation of PCRE with the translation of ..., * and . Thus . matches a
period, * matches non-directory separators, and ... matches any number of
any characters.

it only mentions source or host, but not sourcetype.

Hope this helps ...

cheers, Mus

[ankithreddy777]

Thank you MuS.