props.conf: stanza "host::...." using regex

[ktn01]

Hello,

The documentation says that a stanza [host::<host>] in "props.conf" must be used with a host-pattern

Is it a way to use a regexp?

I have to match host names like "[vp][mnas][pdtiv].*"

[somesoni2 · Accepted solution]

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Propsconf#GLOBAL_SETTINGS

 The stanza name with "host:..." and "source:..." uses PCRE (Perl-compatible regular expressions).

syntax:
... recurses through directories until the match is met
    or equivalently, matches any number of characters.
*   matches anything but the path separator 0 or more times.
    The path separator is '/' on unix, or '\' on Windows.
    Intended to match a partial or complete directory or filename.
|   is equivalent to 'or'
( ) are used to limit scope of |.
\\ = matches a literal backslash '\'.

You can use something like this

[host::(v|p)(m|n|a|s)(p|d|t|i|v)*]