https://community.splunk.com/t5/Getting-Data-In/Pipe-delineated-sourcetype-Stanza/m-p/141111#M28902 <P>You can use wildcards like this:</P> <PRE><CODE>[(?:::){0}sourctype*] </CODE></PRE> Wed, 13 May 2015 07:48:41 GMT woodcock 2015-05-13T07:48:41Z https://community.splunk.com/t5/Getting-Data-In/Pipe-delineated-sourcetype-Stanza/m-p/141110#M28901 <P>I want to know if its possible in props.conf to create one stanza for multiple sourcetypes that doesn't use regex.</P> <P>I want all of my linux logs to check the hostname vs a lookup table that has a plethora of data in it. I need it to check multiple sourcetypes and I don't want to have to copy and paste the stanza over and over.</P> <P>It seems like it should be simple:</P> <PRE><CODE>[sourcetype1|sourcetype2|sourcetype3] LOOKUP-test = lookup_test host OUTPUT ip </CODE></PRE> Fri, 10 Apr 2015 16:08:22 GMT https://community.splunk.com/t5/Getting-Data-In/Pipe-delineated-sourcetype-Stanza/m-p/141110#M28901 michael_kushma 2015-04-10T16:08:22Z https://community.splunk.com/t5/Getting-Data-In/Pipe-delineated-sourcetype-Stanza/m-p/141111#M28902 <P>You can use wildcards like this:</P> <PRE><CODE>[(?:::){0}sourctype*] </CODE></PRE> Wed, 13 May 2015 07:48:41 GMT https://community.splunk.com/t5/Getting-Data-In/Pipe-delineated-sourcetype-Stanza/m-p/141111#M28902 woodcock 2015-05-13T07:48:41Z