topic Re: Is it possible to combine multiple [<spec>] stanza? in Getting Data In

Is it possible to combine multiple [] stanza?

GaetanVP — Fri, 20 Jan 2023 15:54:14 GMT

Hello Splunkers,

Using props.conf file, is it possible to combine multiple [<spec>] stanza ?
I would like to set up a specific LINE_BREAKER but only for a source of a specific host...

Is something like [host::<whatever>] + [source::<whatever>] possible ?

Thanks a lot,

GaetanVP

Re: Is it possible to combine multiple [] stanza?

isoutamo — Fri, 20 Jan 2023 21:52:40 GMT

my understanding is that this is not possible. There are defined on conf file docs how this is working and what is the precedence for those. Somehow you could do this by using clone sourcetype, but probably the way how you are hoping?

r. Ismo

Re: Is it possible to combine multiple [] stanza?

jamie00171 — Fri, 20 Jan 2023 22:48:58 GMT

Hi @GaetanVP ,

I don't think this is possible. However, you can configure LINE_BREAKER to break lines on multiple different sequences of characters e.g. LINE_BREAKER = (\r\n)*({\"time\"|\{\"timestamp\") would break on both {"time" and {"timestamp". I'm not sure if this will meet your requirements but wanted to mention it just in case it does.

Thanks,

Jamie

Re: Is it possible to combine multiple [] stanza?

GaetanVP — Mon, 23 Jan 2023 09:44:11 GMT

Hello @isoutamo,

Okok, indeed I would like to avoid clone sourcetype but I will keep that in mind if needed.

Thanks a lot,

GaetanVP

Re: Is it possible to combine multiple [] stanza?

GaetanVP — Mon, 23 Jan 2023 09:45:19 GMT

Hello @jamie00171,

This can be very useful in my use case, not exactly what I had in mind but it seems to be a real Splunk limitation !

Thanks for your answer,

GateanVP

Re: Is it possible to combine multiple [] stanza?

PickleRick — Mon, 23 Jan 2023 13:47:33 GMT

https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/Propsconf

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

Re: Is it possible to combine multiple [] stanza?

GaetanVP — Tue, 24 Jan 2023 13:03:37 GMT

Hello @PickleRick, thanks for your answer

This give details about settings precedence but I understand there is no possibility to combine stanza

Regards,

GaetanVP

Re: Is it possible to combine multiple [] stanza?

PickleRick — Tue, 24 Jan 2023 13:05:37 GMT

Yes. If you have multiple matching stanzas, results from the highest privilege stanza applies. (If we're talking about overlapping settings)

Re: Is it possible to combine multiple [] stanza?

rokxer — Mon, 23 Sep 2024 13:20:39 GMT

Update: After further testing it does not work.

~~I used~~

~~props.conf~~
~~-------------~~
~~[tcp] AND [host:server1]~~
~~TRANSFORMS-random=filterports~~

~~And it seems to work as expected. Applies the TRANSFORM on for tcp from server1.~~

~~Thou, I didn't seem to find any official documentation.~~

~~It's good if you want to test on a single server before applying to the whole sourcetype.~~

Re: Is it possible to combine multiple [] stanza?

PickleRick — Mon, 23 Sep 2024 13:24:17 GMT

No. It does not work this way.

As I quoted earlier in this thread, the settings are applied in order of stanza precedence (after the final config is decided from separate files according to the configuration files precedence).

So [source::something] settings have highest precedence, then [host::something] and finally just [sourcetype] settings. You can't do logical conditions between those stanzas.