Splunk Search
Highlighted

In Config Files, are Slashes and Backslashes (non stanza headers) treated same?

Communicator

I have a props.conf file where I need to point to a custom DATETIMECONFIG xml file. Now, this file may go to either a Linux box or a Windows box. So right now, my DATETIMECONFIG line looks as such:

DATETIMECONFIG = ./FILEdatetime.xml

Will Splunk properly interpret this on both Windows and Linux? Or do I have to make special props.conf files for Linux and Windows, the latter being one with Backslashes instead?

I know they must be different when it comes to Stanza Headers. But being able to use RegEx in those helps, so I can do something like "source::.[\/]pathname[\/]filename.ext". But I'm not sure if that works in a VALUE under the stanza.

Thanks.

  • James
0 Karma
Highlighted

Re: In Config Files, are Slashes and Backslashes (non stanza headers) treated same?

Communicator

Also, I just learned that relative path doesn't seem to work for that variable. It HAS to be the "full" path from "$SPLUNK_HOME$".

0 Karma
Highlighted

Re: In Config Files, are Slashes and Backslashes (non stanza headers) treated same?

Influencer

As far as I know there is no path delimiter normalization in Splunk atm. At least with file monitors and scripted inputs this is the case. So my guess is you will have to create a separate props.conf for Windows.

0 Karma