topic Re: Props.conf wild card help in Getting Data In

Props.conf wild card help

SS1 — Tue, 21 Sep 2021 02:45:19 GMT

Hi,

I have the below source, values in Red will keep changing

source="/Application/logs/b80be40606aa7860f7de0c7ffa6b9d740581ec6035bc450ff5dfa3/apply-service/example.google.local:9818/Application-services/applyy-service:build-000/apply-service-464-xmp/system-out-dev.stdout"

in props.conf i tried below definitions but it is unable to pickup, how can i use wild cards to pick the correct source?

[source::/Application*]

TRANSFORMS-anonymize = address-anonymizer

[source::/Application/logs/*/apply-service/*/Application-services/*/*/system-out-dev.stdout]

TRANSFORMS-anonymize = address-anonymizer

Re: Props.conf wild card help

danielcj — Wed, 22 Sep 2021 04:51:16 GMT

Hello,

The second option of the use of wild cards is correct.

Are these events being indexed at splunk? If not, please verify if the inputs.conf file is configured correctly.

Also, as you are using the TRANSFORMS, do you have a transforms.conf file with the address-anonymizer definition?

Re: Props.conf wild card help

SS1 — Wed, 22 Sep 2021 05:27:55 GMT

yes, Transforms.conf has address-anonymizer definition. Nope that wild card is not working

Re: Props.conf wild card help

SS1 — Wed, 22 Sep 2021 05:28:33 GMT

any thoughts @gcusello @ITWhisperer

Re: Props.conf wild card help

isoutamo — Wed, 22 Sep 2021 13:08:52 GMT

As said by @danielcj 2nd option should be ok.

Are you sure that you haven't several matching spec definition for that source on props.conf? If there are then splunk selects the 1st in ASCII order.

You haven't any full Splunk Enterprise instances before indexer (?) where you are using this props.conf?

One option is define own source type for this in UF's inputs.conf and then match this with it on indexer (or HF if you have those before indexer).

r. Ismo