Getting Data In

Does Splunk now support wildcards for props.conf?

briancronrath
Contributor

I am trying to interpret http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/Attributeprecedencewithinafile

In the past we've had to do a hack which was essentially [{?:::){0}*(stuffhere|otherstuffetc)] to get pattern matching to work.

But reading through that splunk doc it seems you can simply put the wildcard character right in there now? I'm also wondering about the defaults for priority of 0 for "pattern matching" versus "literal matching". If we have carry over stanzas with that old hack version, are those counted as pattern matching or literal matching?

Tags (2)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Wildcards for host and source have always been supported, as used on that page. I don't see anything on there that implies sourcetype wildcards.

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Wildcards for host and source have always been supported, as used on that page. I don't see anything on there that implies sourcetype wildcards.

View solution in original post

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!