Archive

Missing source types

mhale1982
Path Finder

I just installed Splunk 5.0.1, and I'm missing the cisco_syslog source, along with a bunch of others.

In fact, when I define a source, my only options are:

  • access_combined
  • apache_error
  • csv
  • iis
  • log4j
  • log4php
  • syslog

Any ideas?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Out of the box Splunk comes with only a few pre-defined sourcetypes. It's up to you to define your own for other data sources you might have. Support for various log sources is commonly made possible through apps available here on splunkbase - http://splunk-base.splunk.com/apps - and these apps might have various requirements on what sourcetypes you should be using, so check what sourcetypes you need, then use those.

View solution in original post

Ayn
Legend

Out of the box Splunk comes with only a few pre-defined sourcetypes. It's up to you to define your own for other data sources you might have. Support for various log sources is commonly made possible through apps available here on splunkbase - http://splunk-base.splunk.com/apps - and these apps might have various requirements on what sourcetypes you should be using, so check what sourcetypes you need, then use those.

View solution in original post

mhale1982
Path Finder

Ahhhhhh...gotcha. Dude, that makes no sense. Why would the from-list not have all the options and require you to manually type it in?

Thank you very much for your help...that solved it. 🙂

0 Karma

Ayn
Legend

That's a list of the sourcetypes there is support for yes - however the list in the manager in the web interface doesn't include them all. I could agree that it would be a good idea to include them instead, but as it stands these are the only ones in the list. It's no problem though to just specify the sourcetype you want yourself instead by choosing "Manual" instead of "From list".

0 Karma

mhale1982
Path Finder

That answer is in direct contradiction to this:

http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Listofpretrainedsourcetypes

Your answer meshes what I'm experiencing out of the box, but it contradicts how the software should be behaving, based on the manual.

0 Karma

lguinn2
Legend

And almost all of the apps are free...

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!