topic Re: Custom name for Sourcetype in Getting Data In

Custom name for Sourcetype

ghannemann — Wed, 27 Feb 2013 01:51:08 GMT

I have a forwarder pushing java log data to an indexer. The inputs on the index was set to log4j. However in the basic summary screen, the sourcetype is shown as server.
Why is this?

Is there anyway to rename this sourcetype, or creating based on an existing one with a different name?

Regards,
Gerhard

Re: Custom name for Sourcetype

sbrant_splunk — Wed, 27 Feb 2013 03:38:08 GMT

Your description is a bit confusing. You say that "the inputs on the index was set to log4j", do you mean that the inputs.conf file on the forwarder, within the stanza collecting this file, has a line that says "sourcetype=log4j"?

Re: Custom name for Sourcetype

sbrant_splunk — Wed, 27 Feb 2013 03:47:08 GMT

You can specify the sourcetype in a few places.

On the forwarder, in inputs.conf:

[monitor://path to log file]
sourcetype=log4j

On the indexer, in props.conf:

[source::full path to log file]
sourcetype=log4j

Re: Custom name for Sourcetype

ghannemann — Tue, 12 Mar 2013 00:20:58 GMT

Whoops, sorry, yes I did mean sourcetype, not index, (had other questions that - mix up of terms). I was trying to see if I could create my own sourcetypes based on existing ones.

Re: Custom name for Sourcetype

ghannemann — Tue, 12 Mar 2013 00:22:11 GMT

Thank you.
I also found it useful to set sourcetype on the forward (universal forwarder) and the receiver as well.