Getting Data In

Is it possible to combine multiple [<spec>] stanza?

GaetanVP
Communicator

Hello Splunkers,

Using props.conf file, is it possible to combine multiple [<spec>] stanza ?
I would like to set up a specific LINE_BREAKER but only for a source of a specific host...

Is something like [host::<whatever>] + [source::<whatever>] possible ?

Thanks a lot,

GaetanVP

Labels (3)
Tags (3)
0 Karma

PickleRick
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/Propsconf

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

 

GaetanVP
Communicator

Hello @PickleRick,  thanks for your answer

This give details about settings precedence but I understand there is no possibility to combine stanza

Regards,

GaetanVP

0 Karma

PickleRick
Ultra Champion

Yes. If you have multiple matching stanzas, results from the highest privilege stanza applies. (If we're talking about overlapping settings)

jamie00171
Communicator

Hi @GaetanVP ,

I don't think this is possible. However, you can configure LINE_BREAKER to break lines on multiple different sequences of characters e.g. LINE_BREAKER = (\r\n)*({\"time\"|\{\"timestamp\") would break on both {"time" and {"timestamp". I'm not sure if this will meet your requirements but wanted to mention it just in case it does.


Thanks, 

Jamie

 

GaetanVP
Communicator

Hello @jamie00171,

This can be very useful in my use case, not exactly what I had in mind but it seems to be a real Splunk limitation !

Thanks for your answer,

GateanVP

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

my understanding is that this is not possible. There are defined on conf file docs how this is working and what is the precedence for those. Somehow you could do this by using clone sourcetype, but probably the way how you are hoping?

r. Ismo

GaetanVP
Communicator

Hello @isoutamo,

Okok, indeed I would like to avoid clone sourcetype but I will keep that in mind if needed.

Thanks a lot,

GaetanVP

0 Karma
Get Updates on the Splunk Community!

New Splunk Observability innovations: Deeper visibility and smarter alerting to ...

You asked, we delivered. Splunk Observability Cloud has several new innovations giving you deeper visibility ...

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...