topic Re: How do you override "source" on a oneshot? in Getting Data In

How do you override "source" on a oneshot?

Ron_Naken — Wed, 11 Aug 2010 03:32:33 GMT

I'm using oneshot to do a one-time import of data:

splunk add oneshot $(pwd)/mydata -sourcetype mytype -index main

However, I am unable to to specify a source override for the data. I want a custom value instead of the default filepath/filename. I tried this:

splunk add oneshot $(pwd)/mydata -sourcetype mytype -index main -source mysource

But this generate an error

Only one "name" parameter can be specified.

Re: How do you override "source" on a oneshot?

V_at_Splunk — Wed, 11 Aug 2010 04:26:53 GMT

Use -rename-source like this

splunk add oneshot $(pwd)/mydata -sourcetype mytype -index main -rename-source mysource

This was a known issue (SPL-32358) and was fixed in Splunk 4.2.

Re: How do you override "source" on a oneshot?

Lowell — Sat, 14 Aug 2010 04:45:11 GMT

Before 4.2, you should be able to override the source by adding a line like this to the beginning of your log file:

***SPLUNK*** source=mysource

Of course this works for sourcetype, host, and index too.

Re: How do you override "source" on a oneshot?

dwaddle — Sat, 23 Jul 2011 02:14:09 GMT

When you say "Before 4.2" is this due to a defect/bug in 4.2, or a change in how Splunk 4.2 works?

Re: How do you override "source" on a oneshot?

Lowell — Mon, 28 Sep 2020 09:46:42 GMT

According to V_at_Splunk, in 4.2, you should be able to use a new parameter called -rename-source, and therefore this work around shouldn't be necessary. (This should still work in 4.2. That said, I'm not sure if the new HEADER_MODE props.conf setting will have any impact on this or not.)