topic What is this 'Learned' file under apps? in Getting Data In

What is this 'Learned' file under apps?

nce054 — Wed, 17 Jun 2015 16:02:27 GMT

I was just poking around to find out why my data had this strange sourcetype history-y2016-m06-d-10, and when I went to C:\Program Files\SplunkUniversalForwarder\etc\apps\learned\local, I found a props.conf and sourcetypes.conf. It's like it has been recording what I have it reading from inputs.conf? What are these files generated for?

Re: What is this 'Learned' file under apps?

yannK — Wed, 17 Jun 2015 16:49:06 GMT

This is the learned app, it is unique to each instance, and dynamically populated.
Where splunk store automatic sourcetypes (for each file that was monitored without specifying a sourcetype)

see the very last remark of this page :
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Whysourcetypesmatter

Re: What is this 'Learned' file under apps?

nce054 — Wed, 17 Jun 2015 17:53:07 GMT

Thanks! That explains it well.

Re: What is this 'Learned' file under apps?

abhinav_maxonic — Wed, 06 Apr 2016 11:56:34 GMT

If we have too many sourcetypes, say around in 1600 in props.conf, does it affects the indexing & search performance ? If yes, it would be great if you could help me understand the logic behind it .

Thanks in Advance !!