Can sourcetype control be applied in props.conf?

[rrussellstscied]

Hopefully a simple question.

I can see that in props.conf you can use source, [source::.../dads_logs/*.log], to control if it's applied but can you use sourcetype:...nameofsourcetype?

Thanks

[somesoni2]

The ... was specific operator to recursively look in a path. Sourcetype is not path so it won't make sense to use ... there. If you're looking to use wildcard in sourcetype name, try something like this

In props.conf

[(?:::){0}*nameofsourcetype*]

[rrussellstscied]

Thanks for the info. I'm not looking for a wildcard but more could I replace in the props file, source:....pathtolog, with [sourcetype:dads_logs], and then the regex, date, and extractions would apply to all logs that come in with a sourcetype of dads_logs?

Sorry - I'm getting dumped into the Splunk world and having some difficulties.

Thanks

[somesoni2]

If all the data that belongs to [source::.../dads_logs/*.log] (within Splunk searchindex=* source=*/dads_logs/*.log) a single sourcetype and that sourcetype is only associated with aforementioned source, then you can replace [source::.../dads_logs/*.log] with [yoursourcetype]'