Knowledge Management

props.conf: stanza "host::...." using regex

ktn01
Path Finder

Hello,

The documentation says that a stanza [host::<host>] in "props.conf" must be used with a host-pattern

Is it a way to use a regexp?

I have to match host names like "[vp][mnas][pdtiv].*"

Labels (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Propsconf#GLOBAL_SETTINGS

 The stanza name with "host:..." and "source:..." uses PCRE (Perl-compatible regular expressions).

syntax:
... recurses through directories until the match is met
    or equivalently, matches any number of characters.
*   matches anything but the path separator 0 or more times.
    The path separator is '/' on unix, or '\' on Windows.
    Intended to match a partial or complete directory or filename.
|   is equivalent to 'or'
( ) are used to limit scope of |.
\\ = matches a literal backslash '\'.

 

You can use something like this

[host::(v|p)(m|n|a|s)(p|d|t|i|v)*]

View solution in original post

0 Karma

somesoni2
Revered Legend

Reference: https://docs.splunk.com/Documentation/Splunk/8.2.2/Admin/Propsconf#GLOBAL_SETTINGS

 The stanza name with "host:..." and "source:..." uses PCRE (Perl-compatible regular expressions).

syntax:
... recurses through directories until the match is met
    or equivalently, matches any number of characters.
*   matches anything but the path separator 0 or more times.
    The path separator is '/' on unix, or '\' on Windows.
    Intended to match a partial or complete directory or filename.
|   is equivalent to 'or'
( ) are used to limit scope of |.
\\ = matches a literal backslash '\'.

 

You can use something like this

[host::(v|p)(m|n|a|s)(p|d|t|i|v)*]
0 Karma
Get Updates on the Splunk Community!

.conf25 Community Recap

Hello Splunkers, And just like that, .conf25 is in the books! What an incredible few days — full of learning, ...

Splunk App Developers | .conf25 Recap & What’s Next

If you stopped by the Builder Bar at .conf25 this year, thank you! The retro tech beer garden vibes were ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...