https://community.splunk.com/t5/Getting-Data-In/Sourcetype-questions/m-p/114705#M23992 <P>How i undestend i must do it on splunk indexer (server) I'm right?</P> Mon, 10 Nov 2014 07:48:58 GMT templier 2014-11-10T07:48:58Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-questions/m-p/114704#M23991 <P>Hello, colleagues!</P> <P>Ask for help. <BR /> I have a log species:</P> <PRE><CODE>Nov 7 17:31:50 domain.domain {"user":"email@domain","mimetype":"image\/gif","filename":"Logo_Facebook.gif","disposition":"attachment","size":5998,"download":false} </CODE></PRE> <P>it is necessary to handle in splunk.</P> <P>Possible to handle this file at the entrance to the forwarder and already transmitted in a suitable form in splunk? </P> <P>Thank you!</P> Mon, 10 Nov 2014 06:22:28 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-questions/m-p/114704#M23991 templier 2014-11-10T06:22:28Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-questions/m-p/114705#M23992 <P>How i undestend i must do it on splunk indexer (server) I'm right?</P> Mon, 10 Nov 2014 07:48:58 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-questions/m-p/114705#M23992 templier 2014-11-10T07:48:58Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-questions/m-p/114706#M23993 <P>Hello, colleagues!</P> <P>Found simply irreplaceable application and creat a sourcetype. <BR /> Called - <A href="https://apps.splunk.com/app/494/">Universal Field Extractor</A></P> Tue, 11 Nov 2014 07:30:12 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-questions/m-p/114706#M23993 templier 2014-11-11T07:30:12Z