I am using Splunk db connect v2. I created identities and connections. I also created a database input. The query displays the table with the different fields.
I don’t know what to enter for source, sourcetype and index. Do I have to create new one? I tried to put the name of my database input in those fields but Splunk displays an alert message.
I am not able to do a search like source=”nameofmyinput”.
Could you please help me with that?
You can enter anything you like for sourcetype (or let splunk pick/set it for you) but source should not even be settable by you. There should be a listbox for picking index from a list of what already exists on your Indexers. Set the sourcetype to something you know is unique like ThisSourcetypeIsUnique and then try a search like this: