Documentation: 3.2.3
Print Version Contents
This page last updated: 02/22/08 02:02pm

Recognize Source Types

Create new source types to describe your data input sources.

Filename

  • props.conf (within any subdirectory of $SPLUNK_HOME/etc/bundles/)

Format

[source::<path>]
sourcetype=mySourceType
...

Create a new configuration with the path to your file (or files) and the name you wish to assign as a sourcetype.

Examples

[source::/var/log/netinfo.log]
sourcetype=netinfo_log
[source::/var/log/httpd/mywebsite_*_log]
sourcetype=mywebsite_log
Previous: Add Input Configurations    |    Next: How Splunk Uses Skins

Comments

No comments have been submitted.

Log in to comment.