https://community.splunk.com/t5/Getting-Data-In/Does-Splunk-now-support-wildcards-for-props-conf/m-p/310895#M58417 <P>Wildcards for host and source have always been supported, as used on that page. I don't see anything on there that implies sourcetype wildcards.</P> Sun, 25 Feb 2018 00:23:32 GMT martin_mueller 2018-02-25T00:23:32Z https://community.splunk.com/t5/Getting-Data-In/Does-Splunk-now-support-wildcards-for-props-conf/m-p/310894#M58416 <P>I am trying to interpret <A href="http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/Attributeprecedencewithinafile">http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/Attributeprecedencewithinafile</A></P> <P>In the past we've had to do a hack which was essentially [{?:::){0}*(stuffhere|otherstuffetc)] to get pattern matching to work.</P> <P>But reading through that splunk doc it seems you can simply put the wildcard character right in there now? I'm also wondering about the defaults for priority of 0 for "pattern matching" versus "literal matching". If we have carry over stanzas with that old hack version, are those counted as pattern matching or literal matching? </P> Fri, 23 Feb 2018 21:01:38 GMT https://community.splunk.com/t5/Getting-Data-In/Does-Splunk-now-support-wildcards-for-props-conf/m-p/310894#M58416 briancronrath 2018-02-23T21:01:38Z https://community.splunk.com/t5/Getting-Data-In/Does-Splunk-now-support-wildcards-for-props-conf/m-p/310895#M58417 <P>Wildcards for host and source have always been supported, as used on that page. I don't see anything on there that implies sourcetype wildcards.</P> Sun, 25 Feb 2018 00:23:32 GMT https://community.splunk.com/t5/Getting-Data-In/Does-Splunk-now-support-wildcards-for-props-conf/m-p/310895#M58417 martin_mueller 2018-02-25T00:23:32Z