Getting Data In

Convert a Sourcetype

dwilson333
New Member

All,

I only use Splunk about once a month, tops. So Please help me out if I use the wrong terms.

I have a "app" which was written by my boss that is pulling in logs from our Siebel CRM servers. it does not specify a sourcetype in the inputs.conf file. My boss would like me to create a sourcetype for Siebel data.

1) How do I create a "sourcetype"
2) How do I convert the old automagically created sourcetype to my new one?

Tags (1)
0 Karma
1 Solution

rroberts
Splunk Employee
Splunk Employee

1.Splunk automagically sourcetypes some input methods (not all ie TCP, UDP) as data comes into Splunk at Index time. Check out:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter

However, as you state, one of the places you can override automatic sourcetyping is in your inputs.conf file.

2.Since sourcetype is an indexed field you would have to clean out the index and re-index the data with your inputs.conf edits. This may not be practical in a production environment, original data sources, missing, etc ...

You should probably leverage sourcetype renaming (aliasing) instead for your boss. This can done via your Manager view -> Fields view -> sourcetype renaming. It is retroactive and takes place at search time. This "renamed field" would also be a knowledge object that could be private just for your boss, anyone with access to the app or global.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Renamesourcetypes

View solution in original post

rroberts
Splunk Employee
Splunk Employee

1.Splunk automagically sourcetypes some input methods (not all ie TCP, UDP) as data comes into Splunk at Index time. Check out:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter

However, as you state, one of the places you can override automatic sourcetyping is in your inputs.conf file.

2.Since sourcetype is an indexed field you would have to clean out the index and re-index the data with your inputs.conf edits. This may not be practical in a production environment, original data sources, missing, etc ...

You should probably leverage sourcetype renaming (aliasing) instead for your boss. This can done via your Manager view -> Fields view -> sourcetype renaming. It is retroactive and takes place at search time. This "renamed field" would also be a knowledge object that could be private just for your boss, anyone with access to the app or global.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Renamesourcetypes

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...