Getting Data In
Highlighted

Props.conf stanza matching hosts with literal pipe in name?

SplunkTrust
SplunkTrust

I would like to build a props stanza for hosts that have a literal pipe in their name. I have tried a few different formulations of this, which are:

[host::*\|*]

[host::(*\|*)]

[host::[^|]+\|[^/]+]

(this one just mapped to all hosts)
[host::*|*]

I would expect that I could just escape the pipe in the props spec, but this isn't working. Does anybody have any insight on this?

0 Karma
Highlighted

Re: Props.conf stanza matching hosts with literal pipe in name?

SplunkTrust
SplunkTrust

This wasn't possible, and so I ended up switching to an alternative set of characters, namely "<" and ">"

View solution in original post

0 Karma