Getting Data In

Choosing the sourcetype

emsecrist
Explorer

I am adding some CMK (checkmk) data to splunk using a custom deployment app. I will be creating a new index. I have some specific questions about the sourcetype.

1. How do I choose the sourcetype to put in the inputs.conf file? Are there guidelines or documentation that can help me choose the correct sourcetype or define a new one.

2. I read some documentation that suggested that splunk will choose the most appropriate sourcetype for you. Is this correct? If so, what should I put in the inputs.conf file? 

3. If I simply make up a new sourcetype and put it in the inputs.conf, does splunk create it for me? Is doing this not a good idea?

Here is an example of the checkmk data:

[1614356357] SERVICE ALERT: ServerNameXXX;Memory;OK;HARD;1;OK - RAM used: 10.76 GB of 15.67 GB, Swap used: 1.96 GB of 4 GB, Total virtual memory used: 12.72 GB of 19.67 GB (64.7%)

 

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

You should think that every different lexical format of events is own sourcetype. You should read more here https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Whysourcetypesmatter 

As you have own script which generates those events you should mane that to own sourcetype. In previous link gives you couple of proposals how this can do. Of course if this is any known format and you could found existing add on from splunkbase you should use it.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

You should think that every different lexical format of events is own sourcetype. You should read more here https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Whysourcetypesmatter 

As you have own script which generates those events you should mane that to own sourcetype. In previous link gives you couple of proposals how this can do. Of course if this is any known format and you could found existing add on from splunkbase you should use it.

r. Ismo

Get Updates on the Splunk Community!

Detecting Brute Force Account Takeover Fraud with Splunk

This article is the second in a three-part series exploring advanced fraud detection techniques using Splunk. ...

Buttercup Games: Further Dashboarding Techniques (Part 9)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Buttercup Games: Further Dashboarding Techniques (Part 8)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...