Getting Data In

Is it possible to have multiple sourcetypes point to one props.conf?

jldebell
Path Finder

I am working with application data that has the same exact format across several applications. The sourcetypes are based on application names. We have a couple of fields that we need to extract. I have a props.conf built, but we want to have a one props.conf to control these settings across the applications. How can I tie the sourcetypes to the one props.conf file?

thanks, Jenn

0 Karma
1 Solution

esix_splunk
Splunk Employee
Splunk Employee

As an additional note, if you are extracting the same data across multiple source types, you should be using a transforms based extraction. This allows you to assign that extraction to different sourcetypes in props.

Refer to the Section in the props.conf spec file :

# * Defining new search-time field extractions. You can define basic search-time field
#   extractions entirely through props.conf. But a transforms.conf component is required if
#   you need to create search-time field extractions that involve one or more of the following:
#       * Reuse of the same field-extracting regular expression across multiple sources,
#         source types, or hosts.
#       * Application of more than one regex to the same source, source type, or host.
#       * Delimiter-based field extractions (they involve field-value pairs that are
#         separated by commas, colons, semicolons, bars, or something similar).
#       * Extraction of multiple values for the same field (multivalued field extraction).
#       * Extraction of fields with names that begin with numbers or underscores.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf

View solution in original post

mparks11
Path Finder

Hey Jenn - check this out. Still a "hack" as far as I know but I tested it out and it worked :). I used it in props in conjunction with a stanza in transforms.conf.

http://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-stan...

In props.conf:

[(::){0}sourcetype:*]
KV_MODE = auto
REPORT-comma-delims = commafields

In transforms.conf:

[commafields]
DELIMS = ","
FIELDS = field1,field2,field3,field4,field5
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

As an additional note, if you are extracting the same data across multiple source types, you should be using a transforms based extraction. This allows you to assign that extraction to different sourcetypes in props.

Refer to the Section in the props.conf spec file :

# * Defining new search-time field extractions. You can define basic search-time field
#   extractions entirely through props.conf. But a transforms.conf component is required if
#   you need to create search-time field extractions that involve one or more of the following:
#       * Reuse of the same field-extracting regular expression across multiple sources,
#         source types, or hosts.
#       * Application of more than one regex to the same source, source type, or host.
#       * Delimiter-based field extractions (they involve field-value pairs that are
#         separated by commas, colons, semicolons, bars, or something similar).
#       * Extraction of multiple values for the same field (multivalued field extraction).
#       * Extraction of fields with names that begin with numbers or underscores.

http://docs.splunk.com/Documentation/Splunk/6.2.2/Admin/Propsconf

jldebell
Path Finder

Thanks for the information. We are testing both options to see which will work best for our situation. Thank you!

0 Karma

somesoni2
Revered Legend

You have a [default] section/GLOBALL SETTINGS in props.conf which will be applied to all the sourcetype definitions in that props.conf/splunk instance. You can specify your configurations there. But ensure that if any sourcetype is not suppose to use the [default] configurations, it has to explicitly overwrite those in it's own definition.

See this for more information, http://docs.splunk.com/Documentation/Splunk/6.1.2/admin/Propsconf

0 Karma

jldebell
Path Finder

Thanks for the information. This was helpful. i can't accept the answer because it is a reply unfortunately.

0 Karma
Get Updates on the Splunk Community!

What’s new on Splunk Lantern in August

This month’s Splunk Lantern update gives you the low-down on all of the articles we’ve published over the past ...

Welcome to the Future of Data Search & Exploration

You have more data coming at you than ever before. Over the next five years, the total amount of digital data ...

This Week's Community Digest - Splunk Community Happenings [8.3.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...