https://community.splunk.com/t5/Getting-Data-In/how-to-identify-sourcetype-forbetter-parsing/m-p/680652#M113714 Hi<BR />Usually you will get some hints about product by looking the directory hierarchy and names on it.<BR />r. Ismo Thu, 14 Mar 2024 07:30:54 GMT isoutamo 2024-03-14T07:30:54Z https://community.splunk.com/t5/Getting-Data-In/how-to-identify-sourcetype-forbetter-parsing/m-p/680566#M113698 <P>I need help in understanding that what sourcetype would be ideal to parse logs of this File type</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="krutika_ag_1-1710342055829.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/29735i5786EF079B21F960/image-size/medium?v=v2&amp;px=400" role="button" title="krutika_ag_1-1710342055829.png" alt="krutika_ag_1-1710342055829.png" /></span></P><P>&nbsp;</P> Wed, 13 Mar 2024 15:04:49 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-identify-sourcetype-forbetter-parsing/m-p/680566#M113698 krutika_ag 2024-03-13T15:04:49Z https://community.splunk.com/t5/Getting-Data-In/how-to-identify-sourcetype-forbetter-parsing/m-p/680567#M113699 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/262703">@krutika_ag</a>,</P><P>you should know where these logs come from, or at least what system produced them.</P><P>If not, you could try using the Splunk automatic&nbsp;recognition but I don't like this solution because the error margin is very large.</P><P>You could open the files and take some strings to search on internet what could be the technologu that produced them and then you could search the relative sourcetype.</P><P>Ciao.</P><P>Giuseppe</P> Wed, 13 Mar 2024 15:14:04 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-identify-sourcetype-forbetter-parsing/m-p/680567#M113699 gcusello 2024-03-13T15:14:04Z https://community.splunk.com/t5/Getting-Data-In/how-to-identify-sourcetype-forbetter-parsing/m-p/680652#M113714 Hi<BR />Usually you will get some hints about product by looking the directory hierarchy and names on it.<BR />r. Ismo Thu, 14 Mar 2024 07:30:54 GMT https://community.splunk.com/t5/Getting-Data-In/how-to-identify-sourcetype-forbetter-parsing/m-p/680652#M113714 isoutamo 2024-03-14T07:30:54Z