topic Re: Getting Data in Getting Data In

Getting Data

akankshayadav — Fri, 02 Jul 2021 08:13:36 GMT

Hi,
I have a folder which has .csv .list .sps .param types of files and I need to index them through inputs.conf. What should i provide in my sourcetype?

Re: Getting Data

venkatasri — Fri, 02 Jul 2021 08:19:42 GMT

@akankshayadav sourcetypes are the names given to data depends on what it is. There are default sourcetypes if they are json, apache access log etc.

If your files are custom data type you can set your own names.

Like - csvdata , your inputs.conf as follows there are additonal fields that you can set like host=<your_host>. I Refer - https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Data/Whysourcetypesmatter

[monitor://<path>] sourcetype=<sourcetype>

---

An upvote would be appreciated and Accept solution if it helps!

Re: Getting Data

gcusello — Fri, 02 Jul 2021 08:23:27 GMT

Hi @akankshayadav,

my hint is to load in a test instance (or index) each kind of file, one by one, to find the correct sourcetype to use, to do this you can use the [Settings -- Add data] guided load interface.

You could also leave Splunk to recognize the sourcetypes, but I don't like, I prefer to maintain more control creating a custom sourcetype for each kind of file.

Then in input.conf you can create a stanza for each kind of file, selecting the source (e.g. csv), the index and the related sourcetype.

Ciao.

Giuseppe