This works, thanks! Using [(?::){0}Snare:Security|XmlWinEventLog]as the stanza specifier applies the rules to both sourcetypes. In response to the original reply, I would combine the sourcetypes, but they do have meaningfully different formats. As you can see, some come direct from Windows machines in XML format and some are forwarded over syslog using Snare, and have been converted to TSV format. I've translated fields into CIM format for each case, but the raw text still differs, so I feel the sourcetype should as well. I could, of course, copy the same text to two stanzas, but in my opinion that's pretty messy. I tried adding wildcards to the sourcetype, but it doesn't work as intended. This isn't intended to be actual regex, but the regex-like syntax encompassing those four operators (..., *, |, ()) specified in Splunk's props.conf definition.
... View more
