topic Does props.conf support wildcards? in Getting Data In

Does props.conf support wildcards?

daniel333 — Wed, 13 Jul 2016 18:40:22 GMT

All,

I found myself writing this props.conf today.

Say I have this:

[tomcat:src:server]
EXTRACT-springapp_name = /var/log/containerlogs/(?.+)/\d in source
EXTRACT-containerid = /var/log/containerlogs/.+/(?.+)/ in source

[tomcat:src:access]
EXTRACT-springapp_name = /var/log/containerlogs/(?.+)/\d in source
EXTRACT-containerid = /var/log/containerlogs/.+/(?.+)/ in source

I could I just do this?

[tomcat:src:*]
EXTRACT-springapp_name = /var/log/containerlogs/(?.+)/\d in source
EXTRACT-containerid = /var/log/containerlogs/.+/(?.+)/ in source

Re: Does props.conf support wildcards?

dshpritz — Wed, 13 Jul 2016 18:53:43 GMT

Not officially. Should it? Yes! But no, it does not.

An unofficial/unsupported/could break in the future solution is this:
http://blogs.splunk.com/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf/

So you would use something like:

[(?::){0}tomcat:src:*]

Again, this is an undocumented way of doing this, so Splunk could take that away at any point, so keep that in mind.

Dave

Re: Does props.conf support wildcards?

somesoni2 — Wed, 13 Jul 2016 18:54:28 GMT

I believe the stanza for sourcetype doesn't support wild-card/regular expression. The stanza for host:: and source:: do.

http://docs.splunk.com/Documentation/Splunk/6.4.2/Admin/Propsconf

[<spec>]
<spec> can be:
1. <sourcetype>, the source type of an event.
2. host::<host>, where <host> is the host, or host-matching pattern, for an
                 event.
3. source::<source>, where <source> is the source, or source-matching
                     pattern, for an event.

Re: Does props.conf support wildcards?

the_wolverine — Wed, 13 Jul 2016 19:05:21 GMT

I have seen wildcards in source are buggy and don't work as expected. File bugs.

Re: Does props.conf support wildcards?

splunkreal — Fri, 16 May 2025 07:24:55 GMT

Hello @dshpritz looks like this is "officially" documented at https://splunk.my.site.com/customer/s/article/How-To-Use-Wildcards-with-Sourcetype

Re: Does props.conf support wildcards?

isoutamo — Fri, 16 May 2025 14:20:26 GMT

Yes this has added recently into official documentation. But currently there are still e.g. appinspector which didn't accept it in Cloud vetting. What I have heard this will be fixed soon, so then you could use it officially with Cloud too.