Here is a quick one I use often. Here is an excerpt from props.conf.spec:
[<spec>] * This stanza enables properties for a given <spec>. <spec> can be: 1. <sourcetype>, the source type of an event. 2. host::<host>, where <host> is the host, or host-matching pattern, for an event. 3. source::<source>, where <source> is the source, or source-matching pattern, for an event. 4. rule::<rulename>, where <rulename> is a unique name of a source type classification rule. 5. delayedrule::<rulename>, where <rulename> is a unique name of a delayed source type classification rule. These are only considered as a last resort before generating a new source type based on the source seen.
However, I often want to wildcard a sourcetype for things like lookups. Here is an example, suppose I have the following sourcetypes:
It would be nice to have a stanza in props.conf that read something like:
CAUTION – THIS DOES NOT WORK
[acme:*] LOOKUP-acme = lookup acme_users user_id AS user_id OUTPUTNEW user_name AS user_name FirstName AS FirstName LastName AS LastName
So that doesn’t work, but this regex magic does work:
[(?::){0}acme:*] LOOKUP-acme = lookup acme_users user_id AS user_id OUTPUTNEW user_name AS user_name FirstName AS FirstName LastName AS LastName
The Splunk platform removes the barriers between data and action, empowering observability, IT and security teams to ensure their organizations are secure, resilient and innovative.
Founded in 2003, Splunk is a global company — with over 7,500 employees, Splunkers have received over 1,020 patents to date and availability in 21 regions around the world — and offers an open, extensible data platform that supports shared data across any environment so that all teams in an organization can get end-to-end visibility, with context, for every interaction and business process. Build a strong data foundation with Splunk.