Implementing Splunk 7, Third Edition - Third Edition

Attributes with class

As you dig into configurations, you will see attribute names of the FOO-bar form.

The word after the dash is generally referred to as the class. These attributes are special in a few ways:

• Attributes merge across files like any other attribute.
• Only one instance of each class will be applied according to the rules described previously.
• The final set of attributes is applied in the ASCII order by the value of the class. Once again, say we are presented with an event with the following fields:

sourcetype=foo_type 
source=/logs/abc/def/gh.log 
host=dns4.nyc.mycompany.com 

And, say this is the configuration snippet:

[foo_type] TRANSFORMS-a = from_sourcetype1, from_sourcetype2 [source::/logs/.../*.log] TRANSFORMS-c = from_source_b ...