Hi I have a input with sourcetype [eventlog].
In props.conf If I use sourcetype as below to define settings it is working.
[eventlog]
...
But if I use wildcards as below my input is not getting parsed according to the configurations defined under below stanza.
[eventlog*]
...
...
May I know whether there is any reason.
↧