All Apps and Add-ons
Highlighted

Splunk Add-on for Unix and Linux: What does [source::....nix] match?

Contributor

Splunk_TA_nix/default/props.conf

What do these match? I have never seen them as file extensions.

[source::....nix]
[source::....aix_secure]
[source::....osxsecure]
[source::....linux
secure]

0 Karma
Highlighted

Re: Splunk Add-on for Unix and Linux: What does [source::....nix] match?

Splunk Employee
Splunk Employee

those are typically just there for for event generation purposes. We have a event generation tool (https://github.com/splunk/eventgen) and older versions of it needed this sort of jiggery-pokery in props.conf to produce sensible output.

Short answer, this is safe to ignore for the vast majority of production use cases.

View solution in original post