topic Re: Missing source types in Getting Data In

Missing source types

mhale1982 — Sat, 15 Dec 2012 00:14:10 GMT

I just installed Splunk 5.0.1, and I'm missing the cisco_syslog source, along with a bunch of others.

In fact, when I define a source, my only options are:

access_combined
apache_error
csv
iis
log4j
log4php
syslog

Any ideas?

Re: Missing source types

Ayn — Sat, 15 Dec 2012 09:34:18 GMT

Out of the box Splunk comes with only a few pre-defined sourcetypes. It's up to you to define your own for other data sources you might have. Support for various log sources is commonly made possible through apps available here on splunkbase - http://splunk-base.splunk.com/apps - and these apps might have various requirements on what sourcetypes you should be using, so check what sourcetypes you need, then use those.

Re: Missing source types

lguinn2 — Sat, 15 Dec 2012 09:48:11 GMT

And almost all of the apps are free...

Re: Missing source types

mhale1982 — Mon, 17 Dec 2012 17:18:16 GMT

That answer is in direct contradiction to this:

http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Listofpretrainedsourcetypes

Your answer meshes what I'm experiencing out of the box, but it contradicts how the software should be behaving, based on the manual.

Re: Missing source types

Ayn — Mon, 17 Dec 2012 20:21:18 GMT

That's a list of the sourcetypes there is support for yes - however the list in the manager in the web interface doesn't include them all. I could agree that it would be a good idea to include them instead, but as it stands these are the only ones in the list. It's no problem though to just specify the sourcetype you want yourself instead by choosing "Manual" instead of "From list".

Re: Missing source types

mhale1982 — Mon, 17 Dec 2012 20:42:41 GMT

Ahhhhhh...gotcha. Dude, that makes no sense. Why would the from-list not have all the options and require you to manually type it in?

Thank you very much for your help...that solved it. 🙂