Archive
Highlighted

What is the best way to check the sourcetype?

Path Finder

If I have a file I wish splunk to consume what is the best way to identify it's sourcetype or closest match?

Is data preview able to help?

Tags (2)
0 Karma
Highlighted

Re: What is the best way to check the sourcetype?

SplunkTrust
SplunkTrust

Yep, you can throw it into the data preview to get a first idea of what splunk would make of it and to start working on the settings you need if splunk cannot understand specifics such as timestamps or event braking out of the box.

Highlighted

Re: What is the best way to check the sourcetype?

Path Finder

Many thanks - does the Data preview screen give any indication of potential "Failed to parse timestamp" errors?

0 Karma
Highlighted

Re: What is the best way to check the sourcetype?

SplunkTrust
SplunkTrust

Yeah, it does.

0 Karma
Highlighted

Re: What is the best way to check the sourcetype?

Path Finder

Many thanks, how obvious are these? - when I'm doing data preview I can't seem to spot any issues however when I enable the forwarder I see Failed to parse timestamp errors

0 Karma
Highlighted

Re: What is the best way to check the sourcetype?

SplunkTrust
SplunkTrust

There are many ways to mess up the configuration. Does the data get the correct sourcetype in the inputs.conf on the forwarder? Is the sourcetype fully defined in props.conf on the indexer?

To ease debugging, do post both configuration extracts.

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.