Getting Data In

is it possible to use wildcards, and OR conditions, in sourcetype stanzas

cgnoel
Explorer

I have successfully implemented basic wildcards in sourcetype stanzas as per the this post:
http://splunk-base.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-propsconf-s...

My question is, can you implement an OR condition in the stanza as well. The reason for this is that I am trying to creatively group one set of custom extractions to a various sourcetypes with different naming (and not associate them beyond this scope).

Tags (2)
0 Karma
1 Solution

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

View solution in original post

Ayn
Legend

Yes you can. Because stanza names in props.conf are treated as regular expressions, you just create matching groups separated by |

[(?:::){0}(sourcetype1|sourcetype2|sourcetype3)]

jonuwz
Influencer

Why do you need to make sure its not preceeded with :: ?

Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...