topic Re: Use of wildcard in props.conf in Getting Data In

How can I put that source in props.conf without listing each one separately?

leejones4 — Fri, 08 Jul 2022 20:34:50 GMT

We are trying to filter out events from a Syslog server that is ingesting data for a number of sources but the one we are trying to filter is from our Meraki devices. Each Meraki is considered a source and the sourcetype is meraki. This is a sample of the events coming into Splunk:

2022-07-08 07:14:51.427 xxx.xxx.xxx.xxx 1 Location_XXX flows src=xxx.xxx.0.1 dst=8.8.8.8 mac=70:D3:79:XX:XX:XX protocol=icmp type=8 pattern: allow icmp
host = xxx.xx.0.2source = /syslog0/syslog/meraki/xxx.xx.0.2/messages.log sourcetype = meraki

There are more than 100 sources all using the format: /syslog0/syslog/meraki/<IP Address>/messages.log

How can I put that source in props.conf without listing each one separately?

Re: Use of wildcard in props.conf

danielcj — Fri, 08 Jul 2022 18:41:59 GMT

Hello @leejones4 ,

You could use the sourcetype definition instead of the sources on the props.conf file

For example:

props.conf file [meraki] <YOUR_DEFINITIONS_HERE>

Re: Use of wildcard in props.conf

leejones4 — Fri, 08 Jul 2022 18:53:15 GMT

That's awesome. So I don't need to put the source but can use the sourcetype instead?

Re: Use of wildcard in props.conf

danielcj — Fri, 08 Jul 2022 18:55:27 GMT

Yes, you can use the sourcetype on the props.conf instead of the sources.
You can check it on the docs:

https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf#GLOBAL_SETTINGS

[<spec>]
* This stanza enables properties for a given <spec>.

<spec> can be:
1. <sourcetype>, the source type of an event.