topic Re: Referencing Multiple hosts in Props.conf in Getting Data In

Referencing Multiple hosts in Props.conf

mattsutton — Fri, 11 Apr 2014 09:35:38 GMT

Hi,

Does anyone know if it's possible to create a single props.conf stanza that looks for multiple hosts? I've checked the props.conf spec and example files and had a look around Splunk answers but can't seem to find anything about it, although it seems as though it's possible for multiple sources. What I want to do is something like this:

[host::(192.168.2.52)|(192.168.69.15)|(winxp01)]

TRANSFORMS-null = transform-to-null

This would then reference the following stanza in transforms.conf:

[transform-to-null]

REGEX = .

DEST_KEY = queue

FORMAT = nullQueue

Which would of course send all of the events to the nullQueue, has anyone managed to achieve this?

Thanks,
Matt

Re: Referencing Multiple hosts in Props.conf

lukejadamec — Fri, 11 Apr 2014 12:23:58 GMT

Yes, it can be done. According to the props.conf documentation it can be a single host, or a host matching pattern. Generally, when they say 'matching pattern' they mean regex, so in your case it would be something like this:

[host::(192\.168\.2\.52|192\.168\.69\.15|winxp01)]

But, I've never tried it.

Re: Referencing Multiple hosts in Props.conf

mattsutton — Fri, 11 Apr 2014 14:00:21 GMT

Thanks for your reply lukejadamec. I've already tried things like this but don't seem to have gotten anywhere. At least I now know it's based on regex which I'd forgotten originally! Also I'm not entirely sure which stanza would work anyway, since from my experience with regex I think it would need to be (this)|(that) as oppose to (this|that).

Re: Referencing Multiple hosts in Props.conf

kristian_kolb — Fri, 11 Apr 2014 14:05:07 GMT

No I believe that lukejadamec is right. If it is regex based, it should most likely be (this|that).

Re: Referencing Multiple hosts in Props.conf

mattsutton — Fri, 11 Apr 2014 15:17:18 GMT

Q quick brush up on regex confirms that, still can't seem to get it working though 😞 it has no problem filtering data for two individual hosts but once I make the host this|that or doesn't like it, I'll keep trying some things.

Re: Referencing Multiple hosts in Props.conf

lukejadamec — Fri, 11 Apr 2014 16:00:38 GMT

I found this post where one of the answers explains that you can use some "regex type operators" including pipe as or bounded by ().
http://answers.splunk.com/answers/24274/can-you-have-a-wildcard-in-a-propsconf-stanza-header-when-matching-sourcetypes

I also found more information in the props.conf doc under
**[<spec>] stanza patterns:**

http://docs.splunk.com/Documentation/Splunk/6.0.2/Admin/Propsconf

Re: Referencing Multiple hosts in Props.conf

lukejadamec — Fri, 11 Apr 2014 16:06:00 GMT

I'm going to venture a guess based on the docs that the period is not one of the available regex type operators, so that means they don't need to be escaped. Did you try this:
[host::(192.168.2.52|192.168.69.15|winxp01)]

Re: Referencing Multiple hosts in Props.conf

anwarmian — Mon, 17 Feb 2020 15:56:19 GMT

They don't need to be escaped. Splunk props.conf document should show some examples.

Re: Referencing Multiple hosts in Props.conf

spunk311z — Fri, 17 Jul 2020 07:54:28 GMT

can anyone help with this, i cant find any clear examples in the props.conf docs, and i cant get this to work in props.conf (ive tried many different variations and many escaping techniques ).

[source::(udp:8002|udp:8009|udp:8012)]

EXTRACT-blah......

any of them alone, ofcouse work as intended (ie [source::udp:8002] works)

[source::udp:80**] works but covers too many

thanks

Re: Referencing Multiple hosts in Props.conf

behlkush — Tue, 27 Jul 2021 15:39:05 GMT

This worked for me:

[host::(10.3.4.2|10.12.3.4|IP3|IP4|and_so_on)]