topic Re: Specific props.conf stanza type and supporting documentation? in Getting Data In

Specific props.conf stanza type and supporting documentation?

pkeller — Tue, 15 Jul 2014 15:55:28 GMT

I've noticed in another Splunk environment at my site that they've set up what appear to be undocumented stanzas in props.conf

[foo:BAR]
REPORT-fooregex0=fooregex0

assume that foo is the sourcetype and BAR is a pattern in an event logged in the 'foo' sourcetype.

In the props.conf spec and example, and in numerous web searches I have failed to find a reference to this stanza type ...

Can someone give me some insight or point to some documentation on it?

Thanks very much.

JoeSco27 — Tue, 15 Jul 2014 16:02:17 GMT

This search might help you if you haven't seen it yet.

martin_mueller — Tue, 15 Jul 2014 17:47:12 GMT

Is that the exact spelling save for foo and BAR being changed? Then I'd guess the sourcetype actually is called foo:BAR.