Getting Data In

Is it possible to combine multiple [<spec>] stanza?

GaetanVP
Communicator

Hello Splunkers,

Using props.conf file, is it possible to combine multiple [<spec>] stanza ?
I would like to set up a specific LINE_BREAKER but only for a source of a specific host...

Is something like [host::<whatever>] + [source::<whatever>] possible ?

Thanks a lot,

GaetanVP

Labels (3)
Tags (3)
0 Karma

PickleRick
Ultra Champion

https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/Propsconf

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

 

GaetanVP
Communicator

Hello @PickleRick,  thanks for your answer

This give details about settings precedence but I understand there is no possibility to combine stanza

Regards,

GaetanVP

0 Karma

PickleRick
Ultra Champion

Yes. If you have multiple matching stanzas, results from the highest privilege stanza applies. (If we're talking about overlapping settings)

jamie00171
Communicator

Hi @GaetanVP ,

I don't think this is possible. However, you can configure LINE_BREAKER to break lines on multiple different sequences of characters e.g. LINE_BREAKER = (\r\n)*({\"time\"|\{\"timestamp\") would break on both {"time" and {"timestamp". I'm not sure if this will meet your requirements but wanted to mention it just in case it does.


Thanks, 

Jamie

 

GaetanVP
Communicator

Hello @jamie00171,

This can be very useful in my use case, not exactly what I had in mind but it seems to be a real Splunk limitation !

Thanks for your answer,

GateanVP

 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

my understanding is that this is not possible. There are defined on conf file docs how this is working and what is the precedence for those. Somehow you could do this by using clone sourcetype, but probably the way how you are hoping?

r. Ismo

GaetanVP
Communicator

Hello @isoutamo,

Okok, indeed I would like to avoid clone sourcetype but I will keep that in mind if needed.

Thanks a lot,

GaetanVP

0 Karma
Get Updates on the Splunk Community!

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...