Getting Data In

Is it possible to have multiple sourcetypes point to one props.conf?

jldebell
Path Finder

I am working with application data that has the same exact format across several applications. The sourcetypes are based on application names. We have a couple of fields that we need to extract. I have a props.conf built, but we want to have a one props.conf to control these settings across the applications. How can I tie the sourcetypes to the one props.conf file?

thanks, Jenn

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

As an additional note, if you are extracting the same data across multiple source types, you should be using a transforms based extraction. This allows you to assign that extraction to different sourcetypes in props.

Refer to the Section in the props.conf spec file :

# * Defining new search-time field extractions. You can define basic search-time field
#   extractions entirely through props.conf. But a transforms.conf component is required if
#   you need to create search-time field extractions that involve one or more of the following:
#       * Reuse of the same field-extracting regular expression across multiple sources,
#         source types, or hosts.
#       * Application of more than one regex to the same source, source type, or host.
#       * Delimiter-based field extractions (they involve field-value pairs that are
#         separated by commas, colons, semicolons, bars, or something similar).
#       * Extraction of multiple values for the same field (multivalued field extraction).
#       * Extraction of fields with names that begin with numbers or underscores.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf

View solution in original post

mparks11
Path Finder

Hey Jenn - check this out. Still a "hack" as far as I know but I tested it out and it worked :). I used it in props in conjunction with a stanza in transforms.conf.

http://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-stan...

In props.conf:

[(::){0}sourcetype:*]
KV_MODE = auto
REPORT-comma-delims = commafields

In transforms.conf:

[commafields]
DELIMS = ","
FIELDS = field1,field2,field3,field4,field5
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As an additional note, if you are extracting the same data across multiple source types, you should be using a transforms based extraction. This allows you to assign that extraction to different sourcetypes in props.

Refer to the Section in the props.conf spec file :

# * Defining new search-time field extractions. You can define basic search-time field
#   extractions entirely through props.conf. But a transforms.conf component is required if
#   you need to create search-time field extractions that involve one or more of the following:
#       * Reuse of the same field-extracting regular expression across multiple sources,
#         source types, or hosts.
#       * Application of more than one regex to the same source, source type, or host.
#       * Delimiter-based field extractions (they involve field-value pairs that are
#         separated by commas, colons, semicolons, bars, or something similar).
#       * Extraction of multiple values for the same field (multivalued field extraction).
#       * Extraction of fields with names that begin with numbers or underscores.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf

jldebell
Path Finder

Thanks for the information. We are testing both options to see which will work best for our situation. Thank you!

0 Karma

somesoni2
SplunkTrust
SplunkTrust

You have a [default] section/GLOBALL SETTINGS in props.conf which will be applied to all the sourcetype definitions in that props.conf/splunk instance. You can specify your configurations there. But ensure that if any sourcetype is not suppose to use the [default] configurations, it has to explicitly overwrite those in it's own definition.

See this for more information, http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf

0 Karma

jldebell
Path Finder

Thanks for the information. This was helpful. i can't accept the answer because it is a reply unfortunately.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...