Source type settings in props.conf
This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk:
3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
Source type settings in props.conf
There are source type specific settings in props.conf. Specify settings for a source type using the following attribute/value pairs. Add sourcetype stanza to $SPLUNK_HOME/etc/bundles/local/props.conf or create your own custom bundle directory. Please read more about how configuration files work.
Note: The following attribute/value pairs can only be set for a stanza that begins with [<$SOURCETYPE>]:
invalid_cause = <string>
- Can only be set for a [<sourcetype>] stanza.
- Splunk will not index any data with invalid_cause set.
- Set <string> to "archive" to send the file to the archive processor (specified in unarchive_cmd).
- Set to any other string to throw an error in the splunkd.log if running Splunklogger in debug mode.
- Defaults to empty.
unarchive_cmd = <string>
- Only called if invalid_cause is set to "archive".
- <string> specifies the shell command to run to extract an archived source.
- Must be a shell command that takes input on stdin and produces output on stdout.
- DOES NOT WORK ON BATCH PROCESSED FILES. Use preprocessing_script.
- Defaults to empty.
LEARN_MODEL = <true/false>
- For known sourcetypes, the fileclassifier will add a model file to the learned bundle.
- To disable this behavior for diverse sourcetypes (such as sourcecode, where there is no good exemplar to make a sourcetype) set LEARN_MODEL = false.
- More specifically, set LEARN_MODEL to false if you can easily classify your source by its name or a rule and there's nothing gained from trying to analyze the content.
- Defaults to empty.
maxDist = <integer>
- Determines how different a sourcetype model may be from the current file.
- The larger the value, the more forgiving.
- For example, if the value is very small (e.g., 10), then files of the specified sourcetype should not vary much.
- A larger value indicates that files of the given sourcetype vary quite a bit.
- Defaults to 300.