Is it ok to use ellipsis wildcard more than once?

[Junie]

Is it ok to use ellipsis wildcards (...) more than once to recurses through directories in props.conf's spec stanza?

My path to log: /data/2019/12/22/Site/Engineering/Planning/ip-10-123-45-678/user.log

The spec stanza: [source::/data/.../Planning/.../user.log]
Is this valid?

[kamlesh_vaghela · Accepted solution]

@Junie

I can see the multiple use of ellipsis in the example of stanza pattern collisions: section. Here, below example took for the explanation of stanza pattern collisions so the answer is YES. But if you have multiple stanzas having multiple ellipsis pattern then you should consider pattern collision also.

Example :

[source::...a...]
sourcetype = a

[source::...z...]
sourcetype = z

You can find same example in below link also.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/propsconf#GLOBAL_SETTINGS

[Junie]

Thank you very much!