Typo in wildcard sourcetype renaming stanza name

[lowell80]

The Installation-and-Configuration wiki page appears to have a typo regarding the wildcard sourcetype matching.

https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration

This:
[(::){0}linux*audit]

Should be
[(?::){0}linux*audit]

You were missing the ?

[clothespeg]

I've copied and pasted this many times from the doco so it definitely works. Could you please try and let me know?

[lowell80]

Yeah, I did try it and it fixed my index time issue.. Timestamps weren't being parsed properly, I believe because splunk wasn't matching the wildcarded stanza. Based on a sample event, splunk was trying to use the 00:00 syntax in a "dev" field as a timestamp. So I'm sure some of the events got the right times, but not all of them. (I don't remember testing the search time behavior before I applied the change)

I had to dig a bit to confirm this syntax. It's not documented officially, as you know. And the one splunk answer from 2010 is a bit confusing and does show the syntax you are using (not in the answer, but in a comment).

Here are the things that convinced me on the correct syntax:

1. http://blogs.splunk.com/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf/
2. Splunk uses it in the Splunk_TA_windows app. One of the stanzas use a wildcard sourcetype, and uses the syntax with the ?. (Don't have it in front of me, let me know if you can't find it.)
3. https://answers.splunk.com/answers/397051/can-you-regex-or-wildcard-props-sourcetype-stanzas.html
4. It worked for me. (Put this one last, as its more subjective)

For whatever its worth, I understand splunk well, and regexes well, and even how Splunk translates the standzas patterns into PCRE regexes... but understanding how this trick actually works has always been elusive. A zero occurrence match? Why should it matter if its a capture or non-capture group? I'm guessing that if we had access to the right source code it would all make sense.

[doksu]

Like you say, it's an undocumented feature so how it works I don't actually know. I literally copied it out of another app (I think it was Splunk_TA_windows) and modified for the auditd sourcetypes. Just confirming, the format provided in the documentation here is working for you?