Is it possible to combine multiple [<spec>] stanza?

[GaetanVP]

Hello Splunkers,

Using props.conf file, is it possible to combine multiple [<spec>] stanza ?
I would like to set up a specific LINE_BREAKER but only for a source of a specific host...

Is something like [host::<whatever>] + [source::<whatever>] possible ?

Thanks a lot,

GaetanVP

[rokxer]

Update: After further testing it does not work.

I used 

props.conf
-------------
[tcp] AND [host:server1]
TRANSFORMS-random=filterports

And it seems to work as expected. Applies the TRANSFORM on for tcp from server1.

Thou, I didn't seem to find any official documentation.

It's good if you want to test on a single server before applying to the whole sourcetype.

[PickleRick]

No. It does not work this way.

As I quoted earlier in this thread, the settings are applied in order of stanza precedence (after the final config is decided from separate files according to the configuration files precedence).

So [source::something] settings have highest precedence, then [host::something] and finally just [sourcetype] settings. You can't do logical conditions between those stanzas.

[PickleRick]

https://docs.splunk.com/Documentation/Splunk/9.0.3/Admin/Propsconf

**[<spec>] stanza precedence:**

For settings that are specified in multiple categories of matching [<spec>]
stanzas, [host::<host>] settings override [<sourcetype>] settings.
Additionally, [source::<source>] settings override both [host::<host>]
and [<sourcetype>] settings.

[GaetanVP]

Hello @PickleRick,  thanks for your answer

This give details about settings precedence but I understand there is no possibility to combine stanza

Regards,

GaetanVP

[PickleRick]

Yes. If you have multiple matching stanzas, results from the highest privilege stanza applies. (If we're talking about overlapping settings)

[jamie00171]

Hi @GaetanVP ,

I don't think this is possible. However, you can configure LINE_BREAKER to break lines on multiple different sequences of characters e.g. LINE_BREAKER = (\r\n)*({\"time\"|\{\"timestamp\") would break on both {"time" and {"timestamp". I'm not sure if this will meet your requirements but wanted to mention it just in case it does.

Thanks, 

Jamie

[GaetanVP]

Hello @jamie00171,

This can be very useful in my use case, not exactly what I had in mind but it seems to be a real Splunk limitation !

Thanks for your answer,

GateanVP

[isoutamo]

Hi

my understanding is that this is not possible. There are defined on conf file docs how this is working and what is the precedence for those. Somehow you could do this by using clone sourcetype, but probably the way how you are hoping?

r. Ismo

[GaetanVP]

Hello @isoutamo,

Okok, indeed I would like to avoid clone sourcetype but I will keep that in mind if needed.

Thanks a lot,

GaetanVP