Getting Data In

is it possible to use wildcards, and OR conditions, in sourcetype stanzas

cgnoel
Explorer

I have successfully implemented basic wildcards in sourcetype stanzas as per the this post:
http://splunk-base.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-propsconf-s...

My question is, can you implement an OR condition in the stanza as well. The reason for this is that I am trying to creatively group one set of custom extractions to a various sourcetypes with different naming (and not associate them beyond this scope).

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

View solution in original post

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

jonuwz
Influencer

Why do you need to make sure its not preceeded with :: ?

*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>