I am trying to interpret http://docs.splunk.com/Documentation/Splunk/7.0.2/admin/Attributeprecedencewithinafile
In the past we've had to do a hack which was essentially [{?:::){0}*(stuffhere|otherstuffetc)] to get pattern matching to work.
But reading through that splunk doc it seems you can simply put the wildcard character right in there now? I'm also wondering about the defaults for priority of 0 for "pattern matching" versus "literal matching". If we have carry over stanzas with that old hack version, are those counted as pattern matching or literal matching?
Wildcards for host and source have always been supported, as used on that page. I don't see anything on there that implies sourcetype wildcards.
Wildcards for host and source have always been supported, as used on that page. I don't see anything on there that implies sourcetype wildcards.