Getting Data In

is it possible to use wildcards, and OR conditions, in sourcetype stanzas

cgnoel
Explorer

I have successfully implemented basic wildcards in sourcetype stanzas as per the this post:
http://splunk-base.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-propsconf-s...

My question is, can you implement an OR condition in the stanza as well. The reason for this is that I am trying to creatively group one set of custom extractions to a various sourcetypes with different naming (and not associate them beyond this scope).

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

View solution in original post

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

jonuwz
Influencer

Why do you need to make sure its not preceeded with :: ?

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...