Getting Data In

Wildcards not working in tags.conf

dhughesanz
New Member

I have the below config in tags.conf:

[source=/some/directory/logs/foo-bar/error.log]
sometag = enabled

And this works to tag the event with the source.

However, when I try and use wildcards as per below:

[source=/some/directory/logs/foo*/*.log]
sometag = enabled

The tag is not applied to event with the source. I've tried encoding and escaping the characters but neither are working.

Any ideas?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

According to the tags.conf.spec, "Each stanza can refer to only one field=value", which I interpret to mean wildcards aren't allowed. If you need to specify the same tags for multiple sources, try another field name, like sourcetype=foo.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...