Getting Data In

is it possible to use wildcards, and OR conditions, in sourcetype stanzas

cgnoel
Explorer

I have successfully implemented basic wildcards in sourcetype stanzas as per the this post:
http://splunk-base.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-propsconf-s...

My question is, can you implement an OR condition in the stanza as well. The reason for this is that I am trying to creatively group one set of custom extractions to a various sourcetypes with different naming (and not associate them beyond this scope).

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

View solution in original post

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

jonuwz
Influencer

Why do you need to make sure its not preceeded with :: ?

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...