Answers for "How to configure search-time fields" The latest answers for the question "How to configure search-time fields" Answer by southeringtonp <p>Looks like you already figured out the first part, but just in case, here's a good reference: <br>&nbsp;&nbsp;&nbsp;&nbsp; <a href="" rel="nofollow"></a></p> <p>If you want the extraction to apply to <i>all</i> sourcetypes, then just <b>create your entry in props.conf at the top of the file</b>, outside of any stanza heading. Entries in the file that are not beneath a <code>[stanza]</code> header are considered to be global.</p> <p>There's no way to do a wildcard like <code>[log4j-*]</code>, at least as of Splunk 4.1. There are three main options:</p> <ol> <li>Define the extraction globally, putting your <code>EXTRACT-xxx</code> or <code>REPORT-xxx</code> line at the top of props.conf.</li> <li>Define the extraction multiple times, with a separate stanza for each sourcetype</li> <li>Define the extraction for sourcetype <code>[log4j]</code>, and <a href="" rel="nofollow">rename</a> each log4j-xxx sourcetype. Going forward, manually assign the sourcetype so that you don't get the variations.</li> </ol> <p>Option 3 is usually preferable.</p> Wed, 19 Jan 2011 23:57:32 GMT southeringtonp