This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
Use these instructions to assign a source type based on a source.
Note: This only impacts new data coming in following your configuration change. If you want to correct the source type displayed in Splunk Web for data that has already been indexed, create an alias instead.
Add a stanza for your source in $SPLUNK_HOME/etc/bundles/local/props.conf and set a sourcetype = attribute:
[source::.../var/log/anaconda.log(.\d+)?] sourcetype = anaconda
This sets any events from sources containing the string /var/log/anaconda.log followed by any number of numeric characters to sourcetype=anaconda.
Learn more about props.conf.