Getting Data In

Props.conf wild card help

SS1
Path Finder

Hi,

I have the below source, values in Red will keep changing

source="/Application/logs/b80be40606aa7860f7de0c7ffa6b9d740581ec6035bc450ff5dfa3/apply-service/example.google.local:9818/Application-services/applyy-service:build-000/apply-service-464-xmp/system-out-dev.stdout"

 

in props.conf i tried below definitions but it is unable to pickup, how can i use wild cards to pick the correct source?

1)

[source::/Application*]

TRANSFORMS-anonymize = address-anonymizer

2)

[source::/Application/logs/*/apply-service/*/Application-services/*/*/system-out-dev.stdout]

TRANSFORMS-anonymize = address-anonymizer

 

 

0 Karma

SS1
Path Finder

any thoughts @gcusello @ITWhisperer 

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

As said by @danielcj 2nd option should be ok.

Are you sure that you haven't several matching spec definition for that source on props.conf? If there are then splunk selects the 1st in ASCII order. 

You haven't any full Splunk Enterprise instances before indexer (?) where you are using this props.conf?

One option is define own source type for this in UF's inputs.conf and then match this with it on indexer (or HF if you have those before indexer). 

r. Ismo

0 Karma

SS1
Path Finder

yes, Transforms.conf has address-anonymizer definition. Nope that wild card is not working

 

 

0 Karma

danielcj
Communicator

Hello,

The second option of the use of wild cards is correct. 

Are these events being indexed at splunk? If not, please verify if the inputs.conf file is configured correctly.

Also, as you are using the TRANSFORMS, do you have a transforms.conf file with the address-anonymizer definition?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...

Introduction to Splunk AI

How are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. Lucky for ...