All Apps and Add-ons
Highlighted

Microsoft Azure Add on for Splunk - Sourcetype GUI rename

Contributor

The Microsoft Azure Add on for Splunk allows me to enter a custom sourcetype name.  How is this accomplished in the conf files.  I do not see a custom props or transforms created.  Just wondering how this works so I can add it to one of my custom apps.  This is impressive.  

So for azure:eventhub, as an example, If i name it azure:eventhub:sub001 in the gui, which allows me to search and report easier; i only see azure:eventhub defined in the default/props; however i do not see a custom local/props.conf ; only the custom local/inputs.conf

Labels (2)
0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.