Getting Data In

Props.conf wild card help

SS1
Path Finder

Hi,

I have the below source, values in Red will keep changing

source="/Application/logs/b80be40606aa7860f7de0c7ffa6b9d740581ec6035bc450ff5dfa3/apply-service/example.google.local:9818/Application-services/applyy-service:build-000/apply-service-464-xmp/system-out-dev.stdout"

 

in props.conf i tried below definitions but it is unable to pickup, how can i use wild cards to pick the correct source?

1)

[source::/Application*]

TRANSFORMS-anonymize = address-anonymizer

2)

[source::/Application/logs/*/apply-service/*/Application-services/*/*/system-out-dev.stdout]

TRANSFORMS-anonymize = address-anonymizer

 

 

0 Karma

SS1
Path Finder

any thoughts @gcusello @ITWhisperer 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

As said by @danielcj 2nd option should be ok.

Are you sure that you haven't several matching spec definition for that source on props.conf? If there are then splunk selects the 1st in ASCII order. 

You haven't any full Splunk Enterprise instances before indexer (?) where you are using this props.conf?

One option is define own source type for this in UF's inputs.conf and then match this with it on indexer (or HF if you have those before indexer). 

r. Ismo

0 Karma

SS1
Path Finder

yes, Transforms.conf has address-anonymizer definition. Nope that wild card is not working

 

 

0 Karma

danielcj
Communicator

Hello,

The second option of the use of wild cards is correct. 

Are these events being indexed at splunk? If not, please verify if the inputs.conf file is configured correctly.

Also, as you are using the TRANSFORMS, do you have a transforms.conf file with the address-anonymizer definition?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...