All Apps and Add-ons

How to use own sourcetype and index using the syndication input addon


Hello ,

I have installed the syndication input app from splunk base .I gave the URL and gave custom sourcetype and created new index=webex .But I see data going to index main and having source=/opt/splunk/var/spool/splunk/syndication___RSS_WEBEX_1585256859.14_12157.stash_syndication_input sourcetype=stash_syndication_input-too_small and does not recognize timestamp .I want to use the custom sourcetype and index so that the event breaks correctly and it recognizes the timestamp.How to create an input and which file to edit.

Thanks in Advance

alt text

0 Karma