Set source type for an input
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
Contents
Set source type for an input
Use these instructions to explicitly set a source type for all data coming in via an input.
If you have a directory input (such as tailing /var/log/), this method assigns the same source type for every file in the directory. To assign different source types for each discrete source in the same input directory, set source type for a source instead.
Note: This configuration only impacts new data coming in. To correct the source type displayed in Splunk Web for data that has already been indexed, create an alias instead.
via Splunk Web
When you configure your data inputs through Splunk Web, you can hardcode a sourcetype.
Pick from a list of sourcetypes
If your source is one of Splunk's pre-trained source types, it's a good idea to pick the same name Splunk would try to assign automatically. For a description of Splunk's pre-trained source types, see the sourcetype reference page.
Choose From list from the set source type drop down:
Use a new source type name
Select Manual from the drop down menu at the bottom of the data input screen:
Input your source type name in the Source Type box.
Your events now have that sourcetype= value:
via configuration files
When you configure inputs via inputs.conf, you can set a sourcetype as well. Include a sourcetype = attribute within the appropriate stanza in $SPLUNK_HOME/etc/bundles/local/inputs.conf:
[tcp://:9995] connection_host = dns sourcetype = log4j source = tcp:9995
This sets any events coming from your TCP input on port 9995 as sourcetype=log4j.
dynamically
You can use index-time transformations to set sourcetype dynamically. Here's an example:
props.conf:
[source::udp514] TRANSFORMS-foo = bar
transforms.conf
[bar] REGEX = %PIX DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::pix
This sets any event coming from a UDP input on port 514 and matching the string %PIX as sourcetype pix.
- Note: This configuration will basically run a regex check on every event from that source, which could negatively impact performance. Its best to configure the props.conf stanza to as narrow a spec as possible (see props.conf).