how to add Sourcetype Cli command

parrotgw — Wed, 16 Oct 2019 00:41:24 GMT

hi
i would like add some sourcetype.
Adding thoungh Web Browser is easy,
just click create sourcetype button and not need splunk restart
I found a cli command to add a sourcetype, but I couldn't find it.

One way i found
The sourcetype is written directly to the props.conf file.
but it's need splunk restart

I'm writing an auto define script for some log files
so i can't use restart splunk

i want not need splunk restart & cli command like a web browser

thk~

Re: how to add Sourcetype Cli command

badrinath_itrs — Wed, 16 Oct 2019 11:57:54 GMT

Hi ,

You need to take a look into below documentation as what changes in props.conf requires restart . Any changes to index time field extraction and time stamp properties requires a restart of splunkd process.

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Configurationfilechangesthatrequirerestart

Regarding creating props from command line, this is generally pushed from Cluster master to Indexers or from Deployment server to HWF in distributed environment.

I doubt we have an option to create sourcetype from command line and don't see either in the below link.

https://docs.splunk.com/Documentation/Splunk/7.3.2/Admin/CLIadmincommands

Thanks

topic how to add Sourcetype Cli command in Splunk Search

how to add Sourcetype Cli command

Re: how to add Sourcetype Cli command