I have a props.conf file where I need to point to a custom DATETIMECONFIG xml file. Now, this file may go to either a Linux box or a Windows box. So right now, my DATETIMECONFIG line looks as such:
DATETIMECONFIG = ./FILEdatetime.xml
Will Splunk properly interpret this on both Windows and Linux? Or do I have to make special props.conf files for Linux and Windows, the latter being one with Backslashes instead?
I know they must be different when it comes to Stanza Headers. But being able to use RegEx in those helps, so I can do something like "source::.[\/]pathname[\/]filename.ext". But I'm not sure if that works in a VALUE under the stanza.
As far as I know there is no path delimiter normalization in Splunk atm. At least with file monitors and scripted inputs this is the case. So my guess is you will have to create a separate props.conf for Windows.