Getting Data In

Props.conf stanza matching hosts with literal pipe in name?

muebel
SplunkTrust
SplunkTrust

I would like to build a props stanza for hosts that have a literal pipe in their name. I have tried a few different formulations of this, which are:

[host::*\|*]

[host::(*\|*)]

[host::[^|]+\|[^/]+]

(this one just mapped to all hosts)
[host::*|*]

I would expect that I could just escape the pipe in the props spec, but this isn't working. Does anybody have any insight on this?

0 Karma
1 Solution

muebel
SplunkTrust
SplunkTrust

This wasn't possible, and so I ended up switching to an alternative set of characters, namely "<" and ">"

View solution in original post

0 Karma

muebel
SplunkTrust
SplunkTrust

This wasn't possible, and so I ended up switching to an alternative set of characters, namely "<" and ">"

0 Karma
Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...