All Apps and Add-ons

How to use own sourcetype and index using the syndication input addon


Hello ,

I have installed the syndication input app from splunk base .I gave the URL and gave custom sourcetype and created new index=webex .But I see data going to index main and having source=/opt/splunk/var/spool/splunk/syndication___RSS_WEBEX_1585256859.14_12157.stash_syndication_input sourcetype=stash_syndication_input-too_small and does not recognize timestamp .I want to use the custom sourcetype and index so that the event breaks correctly and it recognizes the timestamp.How to create an input and which file to edit.

Thanks in Advance

alt text

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!