topic Re: Clone new Sourcetype from default in Getting Data In

Clone new Sourcetype from default

shangshin — Tue, 16 Oct 2012 19:38:26 GMT

Hi,

Is there a way to create / clone a new sourcetype say my_csv or my_log4j from the default sourcetype csv, log4j?

Thanks!

Re: Clone new Sourcetype from default

kristian_kolb — Tue, 16 Oct 2012 19:59:07 GMT

Not from the GUI no, but you can find the [log4j] stanza in $SPLUNK_HOME/etc/system/default/props.conf and just copy it to $SPLUNK_HOME/etc/system/local/props.conf. Then you just edit the stanza header [log4j] to [my_log4j] in the new location.

Beware if there are any settings happening in transforms.conf (like REPORT or TRANSFORMS directives in props.conf) that you may also want to edit (if you want them to behave differently than for the original [log4j]).

Hope this helps,

Kristian

Re: Clone new Sourcetype from default

shangshin — Mon, 28 Sep 2020 12:38:29 GMT

I found the csv stanza ni default.prop.conf

[csv]
SHOULD_LINEMERGE = False
pulldown_type = true
CHECK_FOR_HEADER = true
KV_MODE = none

Assuming I want to change the standard delimiter from comma , to semi-colon ; based on this csv stanza, is it feasible?

Thank you!

Re: Clone new Sourcetype from default

kristian_kolb — Wed, 17 Oct 2012 20:41:57 GMT

Yes. Take a look at DELIMS and FIELDS directives for transforms.conf. They should be put in a transforms.conf stanza which is called from props.conf through a REPORT-directive.

I believe you should use DELIMS = ";", with FIELDS = field1, field2 etc.