How to create a props.conf with PCRE in Source?

[Glasses]

Hi

I am monitoring dir paths on a syslog server with a UF.

I have a few sources with different formats under the same sourcetype.

I decided to use a regex to differentiate sources and set their unique formats.

For example I have these two sources...

source 1 = /splunkdata/foobar/serverName/2021-04-06-bar.log

source 2 =/splunkdata/foobar/serverName/2021-04-06-foo-bar.log

I cannot use a "*" wildcard because it is not specific enough,  for example *-bar.log will pickup -foo-bar.log too.

The date prefix changes with the log names so I tried this...

source 1 = /splunkdata/foobar/serverName/\d{4}-\d{2}-\d{2}-bar.log

source 2 =/splunkdata/foobar/serverName/\d{4}-\d{2}-\d{2}-foo-bar.log

but no luck... 😞   

IDK if I messed the regex or this is not possible...  

Any ideas or examples appreciated.

Thank you

[richgalloway · Accepted solution]

Stanza names can contain regular expressions, but only if the name also contains "..." or "*".  Without one of those it's just plain text.

BTW, files with different formats should be different sourcetypes.

[Glasses]

Thx Rich!

I added a star like this and it works now

[source::/splunkdata/foobar/serverName/*\d{4}-\d{2}-\d{2}-foo-bar.log]

There is never anything before the data prefix so I don't think this will have any adverse effects.

[Glasses]

RE: 1 to 1 > sourcetype to format, I agree but the senders did not listen and to rework it is going to take an act of God...  so I try to make it work with source stanzas.

RE: Stanza names can contain regular expressions, but only if the name also contains "..." or "*".  Without one of those it's just plain text.   

I will see if I can apply one of those...

Thank you!