Getting Data In

Is it possible to combine multiple [<spec>] stanza?

GaetanVP
Contributor

Hello Splunkers,

Using props.conf file, is it possible to combine multiple [<spec>] stanza ?
I would like to set up a specific LINE_BREAKER but only for a source of a specific host...

Is something like [host::<whatever>] + [source::<whatever>] possible ?

Thanks a lot,

GaetanVP

Labels (3)
Tags (3)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/Propsconf

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

 

GaetanVP
Contributor

Hello @PickleRick,  thanks for your answer

This give details about settings precedence but I understand there is no possibility to combine stanza

Regards,

GaetanVP

0 Karma

PickleRick
SplunkTrust
SplunkTrust

Yes. If you have multiple matching stanzas, results from the highest privilege stanza applies. (If we're talking about overlapping settings)

jamie00171
Communicator

Hi @GaetanVP ,

I don't think this is possible. However, you can configure LINE_BREAKER to break lines on multiple different sequences of characters e.g. LINE_BREAKER = (\r\n)*({\"time\"|\{\"timestamp\") would break on both {"time" and {"timestamp". I'm not sure if this will meet your requirements but wanted to mention it just in case it does.


Thanks, 

Jamie

 

GaetanVP
Contributor

Hello @jamie00171,

This can be very useful in my use case, not exactly what I had in mind but it seems to be a real Splunk limitation !

Thanks for your answer,

GateanVP

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

my understanding is that this is not possible. There are defined on conf file docs how this is working and what is the precedence for those. Somehow you could do this by using clone sourcetype, but probably the way how you are hoping?

r. Ismo

GaetanVP
Contributor

Hello @isoutamo,

Okok, indeed I would like to avoid clone sourcetype but I will keep that in mind if needed.

Thanks a lot,

GaetanVP

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...