https://community.splunk.com/t5/Getting-Data-In/creating-automatic-sourcetype/m-p/81749#M16870 <P>hi smolcj</P> <P>since sourcetypes for log events are created at index time, you should have a look at docs about <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Propsconf">props</A> and <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Transformsconf">transforms</A> for a start.</P> <P>cheers,</P> <P>MuS</P> Wed, 09 Jan 2013 07:34:27 GMT MuS 2013-01-09T07:34:27Z https://community.splunk.com/t5/Getting-Data-In/creating-automatic-sourcetype/m-p/81748#M16869 <P>hi,<BR /> how to create an automatic sourcetype, which is not there in the splunk list ?<BR /> how we can define the regex so that automatically splunk identifies the sourcetype and index.<BR /> pls help<BR /> thanks</P> Wed, 09 Jan 2013 05:35:26 GMT https://community.splunk.com/t5/Getting-Data-In/creating-automatic-sourcetype/m-p/81748#M16869 smolcj 2013-01-09T05:35:26Z https://community.splunk.com/t5/Getting-Data-In/creating-automatic-sourcetype/m-p/81749#M16870 <P>hi smolcj</P> <P>since sourcetypes for log events are created at index time, you should have a look at docs about <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/admin/Propsconf">props</A> and <A href="http://docs.splunk.com/Documentation/Splunk/5.0.1/Admin/Transformsconf">transforms</A> for a start.</P> <P>cheers,</P> <P>MuS</P> Wed, 09 Jan 2013 07:34:27 GMT https://community.splunk.com/t5/Getting-Data-In/creating-automatic-sourcetype/m-p/81749#M16870 MuS 2013-01-09T07:34:27Z