I have successfully implemented basic wildcards in sourcetype stanzas as per the this post:
http://splunk-base.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-propsconf-s...
My question is, can you implement an OR condition in the stanza as well. The reason for this is that I am trying to creatively group one set of custom extractions to a various sourcetypes with different naming (and not associate them beyond this scope).
Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |
[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]
Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |
[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]
Why do you need to make sure its not preceeded with :: ?