Splunk Add-on for Unix and Linux: What does [source::....nix] match?

[hylam]

Splunk_TA_nix/default/props.conf

What do these match? I have never seen them as file extensions.

[source::....nix]
[source::....aix_secure]
[source::....osx_secure]
[source::....linux_secure]

[jcoates_splunk · Accepted solution]

those are typically just there for for event generation purposes. We have a event generation tool (https://github.com/splunk/eventgen) and older versions of it needed this sort of jiggery-pokery in props.conf to produce sensible output.

Short answer, this is safe to ignore for the vast majority of production use cases.