To clarify, this is an Add-On that gets pushed to workstations, i.e. all machines with the UniversalForwarder installed. The props.conf file would be the one included in the Add-On, not the UniversalForwarder props.conf or server-sided props.conf. I'm trying to package everything into the Add-On to make it as convenient as possible. ... View more

Works like a charm! Thank you so much! ... View more

We ran into this as well. It looks like Splunk 7 has stricter interpretation of the character class construct, so [\S-\S] means "non-whitespace to non-whitespace" instead of "non-whitespace dash non-whitespace." Ultimately this makes the behavior more predictable. ... View more