topic How can I define customize sourcetype that I write logs in _internal? in Getting Data In

How can I define customize sourcetype that I write logs in _internal?

sathiyasun — Tue, 21 Aug 2018 15:36:36 GMT

My custom script writes log in /opt/splunk/var/log/splunk/script.log.

I want the log to be indexed in _internal but have to define a customized sourcetype for the log to write in a proper linebreak. Please let me know how to define sourcetype for the _internal data.

Re: How can I define customize sourcetype that I write logs in _internal?

richgalloway — Tue, 21 Aug 2018 16:53:32 GMT

In your inputs.conf file, add:

[monitor:///opt/splunk/var/log/splunk/script.log]
sourcetype = foo
index = _internal

In your props,conf file, add the following. Adjust the values to match your data.

[foo]
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = ^
TIME_FORMAT = %m/%d/%Y %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 10000
SHOULD_LINEMERGE = false

Re: How can I define customize sourcetype that I write logs in _internal?

sathiyasun — Wed, 22 Aug 2018 14:48:07 GMT

Thanks it works!!!