https://community.splunk.com/t5/Getting-Data-In/sourcetypes/m-p/93308#M19414 <P>We have forwarders sending data to our dedicated indexers. Do we need to set up custom sourcetypes on the forwarders or the indexers?</P> <P>Please point me to documentation if this exists. Thank you!</P> Thu, 15 Mar 2012 15:33:12 GMT jonathan_lam 2012-03-15T15:33:12Z https://community.splunk.com/t5/Getting-Data-In/sourcetypes/m-p/93308#M19414 <P>We have forwarders sending data to our dedicated indexers. Do we need to set up custom sourcetypes on the forwarders or the indexers?</P> <P>Please point me to documentation if this exists. Thank you!</P> Thu, 15 Mar 2012 15:33:12 GMT https://community.splunk.com/t5/Getting-Data-In/sourcetypes/m-p/93308#M19414 jonathan_lam 2012-03-15T15:33:12Z https://community.splunk.com/t5/Getting-Data-In/sourcetypes/m-p/93309#M19415 <P>It depends on the kind of forwarder and the type of configuration. You can set sourcetype in inputs.conf and it would be respected for the life of an event with no problem. </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf">http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf</A></P> <P>If setting it in an input isn't possible, because maybe you want multiple sourcetypes from the same input, then its another story. Universal and Lightweight forwarders do not do parsing, so if you're using those, you'd put your changes on the Indexer. If your using a heavy forwarder, you can put your changes there as data would be parsed by the time it left the output queue. </P> <P><A href="http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F">http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F</A></P> Thu, 15 Mar 2012 17:18:29 GMT https://community.splunk.com/t5/Getting-Data-In/sourcetypes/m-p/93309#M19415 jbsplunk 2012-03-15T17:18:29Z