Getting Data In

Clone new Sourcetype from default

shangshin
Builder

Hi,

Is there a way to create / clone a new sourcetype say my_csv or my_log4j from the default sourcetype csv, log4j?

Thanks!

Tags (2)
1 Solution

kristian_kolb
Ultra Champion

Not from the GUI no, but you can find the [log4j] stanza in $SPLUNK_HOME/etc/system/default/props.conf and just copy it to $SPLUNK_HOME/etc/system/local/props.conf. Then you just edit the stanza header [log4j] to [my_log4j] in the new location.

Beware if there are any settings happening in transforms.conf (like REPORT or TRANSFORMS directives in props.conf) that you may also want to edit (if you want them to behave differently than for the original [log4j]).

Hope this helps,

Kristian

View solution in original post

kristian_kolb
Ultra Champion

Not from the GUI no, but you can find the [log4j] stanza in $SPLUNK_HOME/etc/system/default/props.conf and just copy it to $SPLUNK_HOME/etc/system/local/props.conf. Then you just edit the stanza header [log4j] to [my_log4j] in the new location.

Beware if there are any settings happening in transforms.conf (like REPORT or TRANSFORMS directives in props.conf) that you may also want to edit (if you want them to behave differently than for the original [log4j]).

Hope this helps,

Kristian

kristian_kolb
Ultra Champion

Yes. Take a look at DELIMS and FIELDS directives for transforms.conf. They should be put in a transforms.conf stanza which is called from props.conf through a REPORT-directive.

I believe you should use DELIMS = ";", with FIELDS = field1, field2 etc.

0 Karma

shangshin
Builder

I found the csv stanza ni default.prop.conf

[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
CHECK_FOR_HEADER = true
KV_MODE = none

Assuming I want to change the standard delimiter from comma , to semi-colon ; based on this csv stanza, is it feasible?

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...