Getting Data In

Props.conf wild card help

SS1
Path Finder

Hi,

I have the below source, values in Red will keep changing

source="/Application/logs/b80be40606aa7860f7de0c7ffa6b9d740581ec6035bc450ff5dfa3/apply-service/example.google.local:9818/Application-services/applyy-service:build-000/apply-service-464-xmp/system-out-dev.stdout"

 

in props.conf i tried below definitions but it is unable to pickup, how can i use wild cards to pick the correct source?

1)

[source::/Application*]

TRANSFORMS-anonymize = address-anonymizer

2)

[source::/Application/logs/*/apply-service/*/Application-services/*/*/system-out-dev.stdout]

TRANSFORMS-anonymize = address-anonymizer

 

 

0 Karma

SS1
Path Finder

any thoughts @gcusello @ITWhisperer 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

As said by @danielcj 2nd option should be ok.

Are you sure that you haven't several matching spec definition for that source on props.conf? If there are then splunk selects the 1st in ASCII order. 

You haven't any full Splunk Enterprise instances before indexer (?) where you are using this props.conf?

One option is define own source type for this in UF's inputs.conf and then match this with it on indexer (or HF if you have those before indexer). 

r. Ismo

0 Karma

SS1
Path Finder

yes, Transforms.conf has address-anonymizer definition. Nope that wild card is not working

 

 

0 Karma

danielcj
Path Finder

Hello,

The second option of the use of wild cards is correct. 

Are these events being indexed at splunk? If not, please verify if the inputs.conf file is configured correctly.

Also, as you are using the TRANSFORMS, do you have a transforms.conf file with the address-anonymizer definition?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!