Getting Data In

Choosing the sourcetype

emsecrist
Explorer

I am adding some CMK (checkmk) data to splunk using a custom deployment app. I will be creating a new index. I have some specific questions about the sourcetype.

1. How do I choose the sourcetype to put in the inputs.conf file? Are there guidelines or documentation that can help me choose the correct sourcetype or define a new one.

2. I read some documentation that suggested that splunk will choose the most appropriate sourcetype for you. Is this correct? If so, what should I put in the inputs.conf file? 

3. If I simply make up a new sourcetype and put it in the inputs.conf, does splunk create it for me? Is doing this not a good idea?

Here is an example of the checkmk data:

[1614356357] SERVICE ALERT: ServerNameXXX;Memory;OK;HARD;1;OK - RAM used: 10.76 GB of 15.67 GB, Swap used: 1.96 GB of 4 GB, Total virtual memory used: 12.72 GB of 19.67 GB (64.7%)

 

Labels (3)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

You should think that every different lexical format of events is own sourcetype. You should read more here https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Whysourcetypesmatter 

As you have own script which generates those events you should mane that to own sourcetype. In previous link gives you couple of proposals how this can do. Of course if this is any known format and you could found existing add on from splunkbase you should use it.

r. Ismo

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

You should think that every different lexical format of events is own sourcetype. You should read more here https://docs.splunk.com/Documentation/Splunk/8.1.2/Data/Whysourcetypesmatter 

As you have own script which generates those events you should mane that to own sourcetype. In previous link gives you couple of proposals how this can do. Of course if this is any known format and you could found existing add on from splunkbase you should use it.

r. Ismo

Get Updates on the Splunk Community!

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...

Introducing Ingest Actions: Filter, Mask, Route, Repeat

WATCH NOW Ingest Actions (IA) is the best new way to easily filter, mask and route your data in Splunk® ...