topic Re: Cleaning up props.conf, | (OR) not working for multiple sources in Getting Data In

Cleaning up props.conf, | (OR) not working for multiple sources

jeff — Mon, 28 Sep 2020 10:09:47 GMT

I have the following in props.conf



[source::udp:32001]

TZ                      = UTC

TIME_FORMAT             = %b %d %H:%M:%S

MAX_TIMESTAMP_LOOKAHEAD = 32

BREAK_ONLY_BEFORE_DATE  = True

SHOULD_LINEMERGE        = False

[source::udp:32002]
TZ = UTC
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
BREAK_ONLY_BEFORE_DATE = True
SHOULD_LINEMERGE = False

[source::udp:32006]
TIME_FORMAT = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
BREAK_ONLY_BEFORE_DATE = True
SHOULD_LINEMERGE = False

From what I've read, it seems this should work to "simplify" my props.conf, but when I actually implement this it doesn't work:

[source::udp:32001|udp:32002|udp:32006]
TIME_FORMAT             = %b %d %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 32
BREAK_ONLY_BEFORE_DATE  = True
SHOULD_LINEMERGE        = False

[source::udp:32001|udp:32002]
TZ                      = UTC

With source-specific entries, time settings are correctly interpreted. When I attempt to configure a single stanza with multiple sources using |, it fails (most notably, the log data from udp:32001/2 are shifted 5 hours in the future).

Is this not supported? Or am I just doing it wrong? 🙂

Re: Cleaning up props.conf, | (OR) not working for multiple sources

_d_ — Tue, 29 Nov 2011 21:31:46 GMT

Give this notation a try:

[source::(udp:32001)|(udp:32002)|(udp:32006)]

Also, to troubleshoot further and to see where and what parameters are set for each source use btool :

splunk cmd btool props list [stanza_name]

or, for even more verbosity:

splunk cmd btool --debug props list [stanza_name]

Hope this helps.

> please upvote and accept answer if you find it useful - thanks!

Re: Cleaning up props.conf, | (OR) not working for multiple sources

jeff — Mon, 28 Sep 2020 10:12:24 GMT

Nope - fraid not. Simple test:

[source::(udp:32001)|(udp:32002)|(udp:32006)]
FIELDALIAS-user2 = User_Name as user2

[source::udp:32001]
FIELDALIAS-user = User_Name as user
FIELDALIAS-user3 = User_Name as user3

"user" and "user3" get picked up, "user2" does not. btool picks up the settings and reports the stanza as written in props.conf, so...

Think I'm just going to report a bug and move on.

Re: Cleaning up props.conf, | (OR) not working for multiple sources

dmaislin_splunk — Thu, 08 Dec 2011 15:46:59 GMT

Also, if you want to see a complete view of your Splunk install, install the Splunk on Splunk (SoS) app with SideView Utils. You can see everything about your Splunk environment in one place.

http://splunk-base.splunk.com/apps/29008/sos-splunk-on-splunk

http://splunk-base.splunk.com/apps/22279/sideview-utils