Getting Data In

How come my regexes aren't working in props source matching?

krisreeves
Path Finder

Splunk Enterprise 6.5.4, with dedicated indexer and search head clusters, using config such as this:

transforms.conf:

[set_configured_sourcetype]
REGEX      = .
FORMAT     = sourcetype_configured::1
WRITE_META = true

fields.conf:

[sourcetype_configured]
INDEXED=true

props.conf:

[source::/path/(foo|bar).log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype

Data from foo.log and bar.log do not have sourcetype_configured=1 on them

However, with props.conf:

[source::/path/foo.log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype

[source::/path/bar.log]
priority = 100
TRANSFORMS-setconfigured = set_configured_sourcetype

Things behave as expected. Is there any explanation for this behavior? Other Splunk Answers posts, the docs seem to indicate that regular expressions should be acceptable in this context, and the priority setting should ensure that these stanzas aren't superseded by something else alphabetically.

1 Solution

whrg
Motivator

I had a similar issue once. I found out that regular expressions are not fully supported in stanzas.

However, I got it working like this:

[source::/path/(foo|bar)*.log]

View solution in original post

woodcock
Esteemed Legend

I believe that the wildcarding in use is glob, not RegEx: https://en.m.wikipedia.org/wiki/Glob_(programming)

0 Karma

krisreeves
Path Finder
0 Karma

whrg
Motivator

I had a similar issue once. I found out that regular expressions are not fully supported in stanzas.

However, I got it working like this:

[source::/path/(foo|bar)*.log]

ddrillic
Ultra Champion

I would make it - [source::/path/(foo|bar){1}.log], and regex101.com approves of [source::/path/(foo|bar).log] as well.

The documentation at props.conf brings the following example -

Example: [source::....(?<!tar.)(gz|bz2)]

This matches any file ending with '.gz' or '.bz2', provided this is not
preceded by 'tar.', so tar.bz2 and tar.gz would not be matched.

0 Karma

krisreeves
Path Finder

Well, I'll take a workaround 🙂 Hopefully someone from splunk can chime in with a why and an explanation at some point...

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...