This documentation does not apply to the most recent version of Splunk.
This documentation applies to the following versions of Splunk: 3.2 , 3.2.1 , 3.2.2 , 3.2.3 , 3.2.4 , 3.2.5 , 3.2.6
Use these instructions to train Splunk to recognize a new source type, or give it new samples to better recognize a pre-trained sourcetype. This enables Splunk to classify future files with similar patterns as a specific source type.
Bypass auto-classification in favor of hardcoded configurations, and just set a sourcetype for an input, or set a sourcetype for a source. Or set your own rules for source type association.
These commands assume you have set a Splunk environment variable. If you have not, navigate to $SPLUNK_HOME/bin and run the ./splunk command.
# splunk train sourcetype $FILE_NAME $SOURCETYPE_NAME
Fill in $FILE_NAME with the entire path to your file. $SOURCETYPE_NAME is the custom source type you wish to create.
It's usually a good idea to train on a few different samples for any new source type so that Splunk learns how varied a source type can be.