https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546883#M91058 <P>Stanza names can contain regular expressions, but only if the name also contains "..." or "*".&nbsp; Without one of those it's just plain text.</P><P>BTW, files with different formats should be different sourcetypes.</P> Tue, 06 Apr 2021 14:55:21 GMT richgalloway 2021-04-06T14:55:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546872#M91055 <P>Hi</P><P>I am monitoring dir paths on a syslog server with a UF.</P><P>I have a few sources with different formats under the same sourcetype.</P><P>I decided to use a regex to differentiate sources and set their unique formats.</P><P>&nbsp;</P><P>For example I have these two sources...</P><P>source 1 = /splunkdata/foobar/serverName/2021-04-06-bar.log</P><P>source 2 =/splunkdata/foobar/serverName/2021-04-06-foo-bar.log</P><P>I cannot use a "*" wildcard because it is not specific enough,&nbsp; for example *-bar.log will pickup -foo-bar.log too.</P><P>The date prefix changes with the log names so I tried this...</P><P>source 1 = /splunkdata/foobar/serverName/\d{4}-\d{2}-\d{2}-bar.log</P><P>source 2 =/splunkdata/foobar/serverName/\d{4}-\d{2}-\d{2}-foo-bar.log</P><P>but no luck... <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span>&nbsp; &nbsp;</P><P>IDK if I messed the regex or this is not possible...&nbsp;&nbsp;</P><P>Any ideas or examples appreciated.</P><P>Thank you</P><P>&nbsp;</P> Tue, 06 Apr 2021 13:46:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546872#M91055 Glasses 2021-04-06T13:46:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546883#M91058 <P>Stanza names can contain regular expressions, but only if the name also contains "..." or "*".&nbsp; Without one of those it's just plain text.</P><P>BTW, files with different formats should be different sourcetypes.</P> Tue, 06 Apr 2021 14:55:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546883#M91058 richgalloway 2021-04-06T14:55:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546886#M91059 <P>RE: 1 to 1 &gt; sourcetype to format, I agree but the senders did not listen and to rework it is going to take an act of God...&nbsp; so I try to make it work with source stanzas.</P><P>RE:&nbsp;<SPAN>Stanza names can contain regular expressions, but only if the name also contains "..." or "*".&nbsp; Without one of those it's just plain text.&nbsp; &nbsp;</SPAN></P><P><SPAN>I will see if I can apply one of those...</SPAN></P><P><SPAN>Thank you!</SPAN></P><P>&nbsp;</P> Tue, 06 Apr 2021 15:00:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546886#M91059 Glasses 2021-04-06T15:00:21Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546905#M91064 <P>Thx Rich!</P><P>&nbsp;</P><P>I added a star like this and it works now</P><LI-CODE lang="markup">[source::/splunkdata/foobar/serverName/*\d{4}-\d{2}-\d{2}-foo-bar.log]</LI-CODE><P>&nbsp;</P><P>There is never anything before the data prefix so I don't think this will have any adverse effects.</P> Tue, 06 Apr 2021 18:21:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-a-props-conf-with-PCRE-in-Source/m-p/546905#M91064 Glasses 2021-04-06T18:21:42Z