Splunk Enterprise 6.5.4, with dedicated indexer and search head clusters, using config such as this:
transforms.conf:
[set_configured_sourcetype]
REGEX = .
FORMAT = sourcetype_configured::1
WRITE_META = true
fields.conf:
[sourcetype_configured]
INDEXED=true
props.conf:
[source::/path/(foo|bar).log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype
Data from foo.log
and bar.log
do not have sourcetype_configured=1
on them
However, with props.conf:
[source::/path/foo.log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype
[source::/path/bar.log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype
Things behave as expected. Is there any explanation for this behavior? Other Splunk Answers posts, the docs seem to indicate that regular expressions should be acceptable in this context, and the priority setting should ensure that these stanzas aren't superseded by something else alphabetically.
I had a similar issue once. I found out that regular expressions are not fully supported in stanzas.
However, I got it working like this:
[source::/path/(foo|bar)*.log]
I believe that the wildcarding in use is glob
, not RegEx
: https://en.m.wikipedia.org/wiki/Glob_(programming)
It definitely uses regex, see the docs at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in-... (search "PCRE")
I had a similar issue once. I found out that regular expressions are not fully supported in stanzas.
However, I got it working like this:
[source::/path/(foo|bar)*.log]
I would make it - [source::/path/(foo|bar){1}.log]
, and regex101.com
approves of [source::/path/(foo|bar).log]
as well.
The documentation at props.conf brings the following example -
Example: [source::....(?<!tar.)(gz|bz2)]
This matches any file ending with '.gz' or '.bz2', provided this is not
preceded by 'tar.', so tar.bz2 and tar.gz would not be matched.
Well, I'll take a workaround 🙂 Hopefully someone from splunk can chime in with a why and an explanation at some point...