Hi everyone,
I am using Splunk db connect v2. I created identities and connections. I also created a database input. The query displays the table with the different fields.
I don’t know what to enter for source, sourcetype and index. Do I have to create new one? I tried to put the name of my database input in those fields but Splunk displays an alert message.
I am not able to do a search like source=”nameofmyinput”.
Could you please help me with that?
Thanks in advance,
Claire
You can enter anything you like for sourcetype
(or let splunk pick/set it for you) but source
should not even be settable by you. There should be a listbox for picking index
from a list of what already exists on your Indexers. Set the sourcetype to something you know is unique like ThisSourcetypeIsUnique
and then try a search like this:
index=* sourcetype="ThisSourcetypeIsUnique"
You can enter anything you like for sourcetype
(or let splunk pick/set it for you) but source
should not even be settable by you. There should be a listbox for picking index
from a list of what already exists on your Indexers. Set the sourcetype to something you know is unique like ThisSourcetypeIsUnique
and then try a search like this:
index=* sourcetype="ThisSourcetypeIsUnique"
Thank you very much for your help.