Getting Data In

Can I route based on wildcard source

Path Finder

Can I say this?

[source::/usr/local/blackboard/*]
TRANSFORMS-routing=otherRouting

In my inputs, I have pretty long list of such files, some with wildcards themsleves... Can I route all of it with one stanza in the props.conf.

0 Karma

Splunk Employee
Splunk Employee

Yes. However you should note that "*" only matches with a directory segment, so if you want files within subdirectories to be routed, you should use "..." instead.