How can I put that source in props.conf without listing each one separately?

[leejones4]

We are trying to filter out events from a Syslog server that is ingesting data for a number of sources but the one we are trying to filter is from our Meraki devices.  Each Meraki is considered a source and the sourcetype is meraki.  This is a sample of the events coming into Splunk:

2022-07-08 07:14:51.427 xxx.xxx.xxx.xxx 1 Location_XXX flows src=xxx.xxx.0.1 dst=8.8.8.8 mac=70:D3:79:XX:XX:XX protocol=icmp type=8 pattern: allow icmp
host = xxx.xx.0.2source = /syslog0/syslog/meraki/xxx.xx.0.2/messages.log sourcetype = meraki

There are more than 100 sources all using the format:  /syslog0/syslog/meraki/<IP Address>/messages.log

How can I put that source in props.conf without listing each one separately? 

[danielcj]

Hello @leejones4 ,

You could use the sourcetype definition instead of the sources on the props.conf file

For example:

props.conf file

[meraki]
<YOUR_DEFINITIONS_HERE>

[leejones4]

That's awesome.  So I don't need to put the source but can use the sourcetype instead?

[danielcj · Accepted solution]

Yes, you can use the sourcetype on the props.conf instead of the sources. 
You can check it on the docs: 

https://docs.splunk.com/Documentation/Splunk/9.0.0/Admin/Propsconf#GLOBAL_SETTINGS

[<spec>]
* This stanza enables properties for a given <spec>.

<spec> can be:
1. <sourcetype>, the source type of an event.