Specify all hosts or sources in props

[lucacaldiero]

How can I specify all host or sources in a stanza of props.conf?

Thank you

@gcusello 

[gcusello]

Hi @lucacaldiero ,

only for source and host, you can use the asterisk in the props.conf, e.g.:

[host::nyc*]
... 

or

[source::/var/log/*]
...

not for sourcetype that must be exactly declared.

Ciao.

Giuseppe

[PickleRick]

1. Please don't tag specific people in a question. This is not a "free support" group. It's a community-driven forum where people simply voluntarily help each other if/when they have spare time. Tagging specific people might not only look "demanding" from the tagged person(s) but may also make others ignore your question.

2. Depends on what you want to achieve. A source-based stanza like in @livehybrid 's post is one way. Another way to target all data could be to use the [default] stanza.

[livehybrid]

Hi @lucacaldiero 

You can use the following stanza to target all sources in props:

[source::...]
yourKey=yourVal

... recurses through directories until the match is met
or equivalently, matches any number of characters.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing