Documentation: 3.4.1
|  Print Version Contents
This page last updated: 07/01/08 05:07pm

streams.conf

streams.conf.example

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains an example streams.conf.  Use this file to configure filters for live tail.
#
# To use one or more of these configurations, copy the configuration block into
# streams.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

# This example sets up a Live Splunk named apache errors, that is filtered with the search "error
# sourcetype=apache."  Customize the name and search string as you see fit.

[stream:apacheerrors]
filter = error sourcetype=apache

streams.conf.spec

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0
#
# This file controls filters for live tail, (real-time view of data as it's indexed).
# Apply search filters so just the data you are interested shows up in the live tail interface.
#
# There is a streams.conf in $SPLUNK_HOME/etc/system/default/.  To set custom configurations, 
# place a streams.conf in $SPLUNK_HOME/etc/system/local/.  For examples, see streams.conf.example.
# You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/doc/latest/admin/BundlesIntro.

[stream:<stream name>]
        * You may have as many of these stanzas as you wish.  
        * CAUTION: DO NOT USE THE NAME "livetail" as it is reserved by the system.
        
filter = <search string>
        * Filter your live tail data on a search string.
        * This filter is applied to the stream above.
        * Currently, these searches CANNOT include piping.
        * You can use the following fields (and ONLY the following fields) in your filter:
    source, sourcetype, host.
Previous: sourcetypes.conf    |    Next: strings.conf

Comments

No comments have been submitted.

Log in to comment.