https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-splunk/m-p/509538#M86670 <P>Hi,</P> <P>After setted a source by inputs.conf where inside is specified a sourcetype="something" and index="something".</P> <P>Sources come from by UFs.</P> <P>So the question: is insert sourcetype into that file inputs.conf enough or do I also have to create sourcetype in the GUI so I mean into settings &gt; sourcetype.</P> Thu, 16 Jul 2020 16:13:31 GMT dani9 2020-07-16T16:13:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-splunk/m-p/509538#M86670 <P>Hi,</P> <P>After setted a source by inputs.conf where inside is specified a sourcetype="something" and index="something".</P> <P>Sources come from by UFs.</P> <P>So the question: is insert sourcetype into that file inputs.conf enough or do I also have to create sourcetype in the GUI so I mean into settings &gt; sourcetype.</P> Thu, 16 Jul 2020 16:13:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-splunk/m-p/509538#M86670 dani9 2020-07-16T16:13:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-splunk/m-p/509542#M86672 <P>You can specify a new index and sourcetype from the stanza, you do not need to do this again in the GUI. I suggest testing the new data before fully committing to adding it to Splunk. To test just goto the GUI and use the Add Data option and select Index Once vs Continuously Monitor.</P> Thu, 16 Jul 2020 15:22:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-splunk/m-p/509542#M86672 wedge22 2020-07-16T15:22:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-splunk/m-p/509545#M86673 <P>Just mentioning the sourcetype in inputs.conf is enough.</P> Thu, 16 Jul 2020 15:52:16 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-data-into-splunk/m-p/509545#M86673 venkateshparank 2020-07-16T15:52:16Z