Edit manually created Source types

rhansen — Tue, 11 Dec 2012 21:03:30 GMT

I recently added a log file to be monitored. It required me to define a custom source type in order to parse it. I noticed that my RegEx was not well defined and needed to be modified. I can find no way to modify my custom source type, or even delete it for that matter. How do I edit it?

Re: Edit manually created Source types

rishiehari — Wed, 12 Dec 2012 05:09:47 GMT

You will have to change the configuration file of splunk.

Name of the file : "props.conf"
Location (Recommended) : $SPLUNK_DIR\etc\system\local\

Any new sourcetype you had created would have an entry similar to this

[config]
NO_BINARY_CHECK =1
pulldown_type = 1
SHOULD_LINEMERGE = true

Edit wherever you want it to, and you can create new sourcetypes here as well.

Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf

topic Edit manually created Source types in Getting Data In

Edit manually created Source types

Re: Edit manually created Source types