Getting Data In

Can a sourcetype be applied on the server, or does it need to be applied in the forwarder?


I am trying to set up a universal forwarder with an inputs.conf which only contains something like this:


And then have the splunk server apply different sourcetype values to specific logs within that directory with a rule in props.conf like this:

sourcetype = my_sourcetype

However, that does not seem to work. Does the sourcetype need to be defined in inputs.conf on the forwarder machine? Is the syntax of my props.conf correct?

Tags (1)


you should put it in inputs.conf, like

host = your_host_name
sourcetype = your_sourcetype_name
source = your_source_name
index = your_index_name


or you can reassign sourcetype by data routing in props.conf and transforms.conf like

in props.conf
[your sourcetype name]
TRANSFORMS-XXXSourcetyping = XXXSourcetyping

in transforms.conf
DEST_KEY = MetaData:Sourcetype
FORMAT = sourcetype::your_sourcetype_name