Now that we have looked at common attributes, let's talk about the different types of stanzas in props.conf. Stanza definitions can take the following three forms:
- [foo]
- This is the exact name of a source type and is the most common type of stanza to be used; the source type of an event is usually defined in inputs.conf
- Wildcards are not allowed
- [source::/logs/.../*.log]
- This matches the source attribute, which is usually the path to the log where the event came from
- * matches a file or directory name
- ... matches any part of a path
- [host::*nyc*]
- This matches the host attribute, which is usually the value of the hostname on a machine running Splunk Forwarder
- * is allowed
Types follow this order in taking precedence: ...
