https://community.splunk.com/t5/Getting-Data-In/Wildcards-not-working-in-tags-conf/m-p/477549#M99771 <P>I have the below config in tags.conf:</P> <P>[source=/some/directory/logs/foo-bar/error.log]<BR /> sometag = enabled</P> <P>And this works to tag the event with the source.</P> <P>However, when I try and use wildcards as per below:</P> <P>[source=/some/directory/logs/foo*/*.log]<BR /> sometag = enabled</P> <P>The tag is not applied to event with the source. I've tried encoding and escaping the characters but neither are working.</P> <P>Any ideas?</P> Wed, 30 Sep 2020 03:33:53 GMT dhughesanz 2020-09-30T03:33:53Z https://community.splunk.com/t5/Getting-Data-In/Wildcards-not-working-in-tags-conf/m-p/477549#M99771 <P>I have the below config in tags.conf:</P> <P>[source=/some/directory/logs/foo-bar/error.log]<BR /> sometag = enabled</P> <P>And this works to tag the event with the source.</P> <P>However, when I try and use wildcards as per below:</P> <P>[source=/some/directory/logs/foo*/*.log]<BR /> sometag = enabled</P> <P>The tag is not applied to event with the source. I've tried encoding and escaping the characters but neither are working.</P> <P>Any ideas?</P> Wed, 30 Sep 2020 03:33:53 GMT https://community.splunk.com/t5/Getting-Data-In/Wildcards-not-working-in-tags-conf/m-p/477549#M99771 dhughesanz 2020-09-30T03:33:53Z https://community.splunk.com/t5/Getting-Data-In/Wildcards-not-working-in-tags-conf/m-p/477550#M99772 <P>According to the tags.conf.spec, "Each stanza can refer to only one field=value", which I interpret to mean wildcards aren't allowed. If you need to specify the same tags for multiple sources, try another field name, like <CODE>sourcetype=foo</CODE>.</P> Fri, 10 Jan 2020 13:00:22 GMT https://community.splunk.com/t5/Getting-Data-In/Wildcards-not-working-in-tags-conf/m-p/477550#M99772 richgalloway 2020-01-10T13:00:22Z