https://community.splunk.com/t5/Getting-Data-In/Dynamic-sourcetype-setup/m-p/150797#M30675 <P>Hi There, </P> <P>Just wondering whether it is possible to define ONE sourcetype for below csv log files.<BR /> So that we do not need to append into the same csv file (i.e it's already over 8GBs now) for source referencing...</P> <P>i.e <CODE>\\10.252.25.81\Splunk\henry\website_*.csv</CODE></P> <P>E.g.</P> <PRE><CODE>\\10.252.25.81\Splunk\henry\website_20141215.csv \\10.252.25.81\Splunk\henry\website_20141216.csv \\10.252.25.81\Splunk\henry\website_20141217.csv \\10.252.25.81\Splunk\henry\website_201412....csv </CODE></PRE> <P>....etc</P> Mon, 15 Dec 2014 06:55:52 GMT henry_ty_leung 2014-12-15T06:55:52Z https://community.splunk.com/t5/Getting-Data-In/Dynamic-sourcetype-setup/m-p/150797#M30675 <P>Hi There, </P> <P>Just wondering whether it is possible to define ONE sourcetype for below csv log files.<BR /> So that we do not need to append into the same csv file (i.e it's already over 8GBs now) for source referencing...</P> <P>i.e <CODE>\\10.252.25.81\Splunk\henry\website_*.csv</CODE></P> <P>E.g.</P> <PRE><CODE>\\10.252.25.81\Splunk\henry\website_20141215.csv \\10.252.25.81\Splunk\henry\website_20141216.csv \\10.252.25.81\Splunk\henry\website_20141217.csv \\10.252.25.81\Splunk\henry\website_201412....csv </CODE></PRE> <P>....etc</P> Mon, 15 Dec 2014 06:55:52 GMT https://community.splunk.com/t5/Getting-Data-In/Dynamic-sourcetype-setup/m-p/150797#M30675 henry_ty_leung 2014-12-15T06:55:52Z https://community.splunk.com/t5/Getting-Data-In/Dynamic-sourcetype-setup/m-p/150798#M30676 <P>Hi henry_ty_leung,</P> <P>sure, take a look at the docs <A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Inputsconf" target="_blank">http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Inputsconf</A> where you can learn how to set a sourcetype for an input:</P> <PRE><CODE>sourcetype = &lt;string&gt; * Sets the sourcetype key/field for events from this input. </CODE></PRE> <P>cheers, MuS</P> Mon, 28 Sep 2020 18:22:37 GMT https://community.splunk.com/t5/Getting-Data-In/Dynamic-sourcetype-setup/m-p/150798#M30676 MuS 2020-09-28T18:22:37Z