Knowledge Management

props.conf: stanza "host::...." using regex

ktn01
Path Finder

Hello,

The documentation says that a stanza [host::<host>] in "props.conf" must be used with a host-pattern

Is it a way to use a regexp?

I have to match host names like "[vp][mnas][pdtiv].*"

Labels (2)
0 Karma
1 Solution

somesoni2
Revered Legend

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Propsconf#GLOBAL_SETTINGS

 The stanza name with "host:..." and "source:..." uses PCRE (Perl-compatible regular expressions).

syntax:
... recurses through directories until the match is met
    or equivalently, matches any number of characters.
*   matches anything but the path separator 0 or more times.
    The path separator is '/' on unix, or '\' on Windows.
    Intended to match a partial or complete directory or filename.
|   is equivalent to 'or'
( ) are used to limit scope of |.
\\ = matches a literal backslash '\'.

 

You can use something like this

[host::(v|p)(m|n|a|s)(p|d|t|i|v)*]

View solution in original post

0 Karma

somesoni2
Revered Legend

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Propsconf#GLOBAL_SETTINGS

 The stanza name with "host:..." and "source:..." uses PCRE (Perl-compatible regular expressions).

syntax:
... recurses through directories until the match is met
    or equivalently, matches any number of characters.
*   matches anything but the path separator 0 or more times.
    The path separator is '/' on unix, or '\' on Windows.
    Intended to match a partial or complete directory or filename.
|   is equivalent to 'or'
( ) are used to limit scope of |.
\\ = matches a literal backslash '\'.

 

You can use something like this

[host::(v|p)(m|n|a|s)(p|d|t|i|v)*]
0 Karma
Get Updates on the Splunk Community!

Splunk Classroom Chronicles: Training Tales and Testimonials

Welcome to the "Splunk Classroom Chronicles" series, created to help curious, career-minded learners get ...

Access Tokens Page - New & Improved

Splunk Observability Cloud recently launched an improved design for the access tokens page for better ...

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...