Implementing Splunk 7, Third Edition - Third Edition

Stanza types

Now that we have looked at common attributes, let's talk about the different types of stanzas in props.conf. Stanza definitions can take the following three forms:

• [foo]
  • This is the exact name of a source type and is the most common type of stanza to be used; the source type of an event is usually defined in inputs.conf
  • Wildcards are not allowed
• [source::/logs/.../*.log]
  • This matches the source attribute, which is usually the path to the log where the event came from
  • * matches a file or directory name
  • ... matches any part of a path
• [host::*nyc*]
  • This matches the host attribute, which is usually the value of the hostname on a machine running Splunk Forwarder
  • * is allowed

Types follow this order in taking precedence: ...