How come my regexes aren't working in props source matching?

[krisreeves]

Splunk Enterprise 6.5.4, with dedicated indexer and search head clusters, using config such as this:

transforms.conf:

[set_configured_sourcetype]
REGEX      = .
FORMAT     = sourcetype_configured::1
WRITE_META = true

fields.conf:

[sourcetype_configured]
INDEXED=true

props.conf:

[source::/path/(foo|bar).log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype

Data from foo.log and bar.log do not have sourcetype_configured=1 on them

However, with props.conf:

[source::/path/foo.log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype

[source::/path/bar.log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype

Things behave as expected. Is there any explanation for this behavior? Other Splunk Answers posts, the docs seem to indicate that regular expressions should be acceptable in this context, and the priority setting should ensure that these stanzas aren't superseded by something else alphabetically.

[woodcock]

I believe that the wildcarding in use is glob, not RegEx: https://en.m.wikipedia.org/wiki/Glob_(programming)

[krisreeves]

It definitely uses regex, see the docs at http://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf?utm_source=answers&utm_medium=in-... (search "PCRE")

[whrg · Accepted solution]

I had a similar issue once. I found out that regular expressions are not fully supported in stanzas.

However, I got it working like this:

[source::/path/(foo|bar)*.log]

[ddrillic]

I would make it - [source::/path/(foo|bar){1}.log], and regex101.com approves of [source::/path/(foo|bar).log] as well.

The documentation at props.conf brings the following example -

Example: [source::....(?<!tar.)(gz|bz2)]

This matches any file ending with '.gz' or '.bz2', provided this is not
preceded by 'tar.', so tar.bz2 and tar.gz would not be matched.

[krisreeves]

Well, I'll take a workaround 🙂 Hopefully someone from splunk can chime in with a why and an explanation at some point...