Documentation: 3.0.2
|  Print Version Contents
This page last updated: 01/10/08 10:01am

Set source type for an input

Use these instructions to explicitly set a sourcetype for all data coming in via a specific configured input.

If you have a directory input (such as tailing /var/log/), this method assigns the same sourcetype for every file in the directory. To assign different sourcetypes for each discrete source in the same input directory, set sourcetype for a source instead.

Note: This configuration only impacts new data coming in via the input. To correct the sourcetype displayed in SplunkWeb for data that has already been indexed, create an alias instead.

via SplunkWeb

When you configure your data inputs through SplunkWeb, you can hardcode a sourcetype.

Pick from a list of sourcetypes

If your source is one of Splunk's pre-trained sourcetypes, it's a good idea to pick the same name Splunk would try to assign automatically. For a description of Splunk's pre-trained sourcetypes, see the sourcetype reference page.

Choose From list from the set source type drop down:

http://www.splunk.com/assets/doc-images/30_admin10_inputsourcetype/sourectyping.jpg

Use a new sourcetype name

Select Manual from the drop down menu at the bottom of the data input screen:

http://www.splunk.com/assets/doc-images/30_admin10_trainsourcetype/manual.jpg

Input your source type name in the Source Type box.

Your events will now have that sourcetype:: value:

http://www.splunk.com/assets/doc-images/30_admin10_trainsourcetype/sourcetyped.jpg

via configuration files

When you are configuring inputs via inputs.conf, you can set a sourcetype. Include a sourcetype = attribute within the appropriate stanza in $SPLUNK_HOME/etc/bundles/local/inputs.conf:

[tcp://:9995]
connection_host = dns
sourcetype = log4j
source = tcp:9995

This sets any events coming from your TCP input on port 9995 as sourcetype::log4j.

Previous: How source types work    |    Next: Set a source type for a source

Comments

  1. It appears that one needs to restart splunk to make a change in source type actually start working after the data input is created.
    Posted by mgh4 on Jan 16 2008, 1:14pm

  2. We've added many examples throughout this section. I hope they make more sense now.
    Posted by kathleen on Aug 11 2007, 4:02pm

  3. I would like to see an example here. Right now splunk is automatically making lots of non-sensical, confusing source types.
    Posted by rwg on Jun 07 2007, 8:58am

Log in to comment.