Getting Data In

Best Practice for Creating New Sourcetype - Splunk Cloud

dfurtaw
Path Finder

Hi All,

I'm a new Splunk admin working inside of a pretty large Splunk Cloud environment. Historically, the folks on the admin/engineering team have defined custom sourcetypes inside of a custom application that is installed on our SH's and indexers. They have created the sourcetype by adding a stanza in the props.conf and configuring the flags within the stanza.

I'm all for best practices and I wanted to see if the Splunk community could weigh in and point me in the right direction of how I should be creating new custom sourcetypes. Would the best way be to create the sourcetype in the GUI? If so, which app should I be saving the sourcetype in?

I could continue using the current process, although this process requires a rolling restart of our indexers and SH, which causes an outage during each update to the custom app. If there is any other information I should be including, please let me know.

Thank you 🙂

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

IMO, you should maintain the current practice. Using the GUI means changes will be stored in an app's local directory and so will always override any change pushed by a new version of the app. It also means your changes will not be part of the app's Git repository, if you have one.

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

IMO, you should maintain the current practice. Using the GUI means changes will be stored in an app's local directory and so will always override any change pushed by a new version of the app. It also means your changes will not be part of the app's Git repository, if you have one.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Advanced Splunk Data Management Strategies

Join us on Wednesday, May 14, 2025, at 11 AM PDT / 2 PM EDT for an exclusive Tech Talk that delves into ...

Uncovering Multi-Account Fraud with Splunk Banking Analytics

Last month, I met with a Senior Fraud Analyst at a nationally recognized bank to discuss their recent success ...

Secure Your Future: A Deep Dive into the Compliance and Security Enhancements for the ...

What has been announced?  In the blog, “Preparing your Splunk Environment for OpensSSL3,”we announced the ...