I was wondering if it was possible to write a props.conf something similar to the following:
props:
[sourcetype = masterlog_*]
REPORT-extract-various-fields = masterlog_extractions_$1
and then have transforms like this:
[masterlog_extractions_SomeLog1]
Delims = "\t"
Fields = _time,id,src,dest,count,msg
[masterlog_extractions_SomeLog2]
Delims = "\t"
Fields = _time,sub_id,choice,variable,code,quantity
So the idea is that I don't have to write a props & transform for each sourcetype, that I could have one props point to the correct transform & have it just work? Ultimately this will go on the search head to define the fields and I would like to avoid index time extraction.
So in your props do this
[(?::){0}masterlog_*]
REPORT-extract-various-fields = masterlog_extractions_SomeLog1, masterlog_extractions_SomeLog2
As an update, I've tried several methods to perform this and it does not look like it is possible. I've attempted calling it as a * and as a $1 and it is not feeding the events through the parser correctly. My next step will be to put splunk into a debug logging mode so that I can see where exactly it hits, but I need to stand up a test search head so I don't have actual users & logs from the other search apps.