Getting Data In

Wildcards not working in tags.conf

dhughesanz
New Member

I have the below config in tags.conf:

[source=/some/directory/logs/foo-bar/error.log]
sometag = enabled

And this works to tag the event with the source.

However, when I try and use wildcards as per below:

[source=/some/directory/logs/foo*/*.log]
sometag = enabled

The tag is not applied to event with the source. I've tried encoding and escaping the characters but neither are working.

Any ideas?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

According to the tags.conf.spec, "Each stanza can refer to only one field=value", which I interpret to mean wildcards aren't allowed. If you need to specify the same tags for multiple sources, try another field name, like sourcetype=foo.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Your Guide to Splunk Digital Experience Monitoring

A flawless digital experience isn't just an advantage, it's key to customer loyalty and business success. But ...

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...