Getting Data In

is it possible to use wildcards, and OR conditions, in sourcetype stanzas

cgnoel
Explorer

I have successfully implemented basic wildcards in sourcetype stanzas as per the this post:
http://splunk-base.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-propsconf-s...

My question is, can you implement an OR condition in the stanza as well. The reason for this is that I am trying to creatively group one set of custom extractions to a various sourcetypes with different naming (and not associate them beyond this scope).

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

View solution in original post

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

View solution in original post

jonuwz
Influencer

Why do you need to make sure its not preceeded with :: ?

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!