Getting Data In

Create aliases for common sourcetypes

carmitstead
Explorer

I'd like to create a custom name for a common sourcetype. For instance:

inputs.conf

[monitor:///my/special/directory]
sourcetype = custom_syslog

props.conf

[custom_syslog]

Some configuration to make this custom sourcetype

format logs like the syslog sourcetype would be

formatted

[source::/my/special/directory]
sourcetype = custom_syslog

Rename does this in the reverse. I could rename my custom field to syslog with 'rename = syslog' in my props.conf, but that wouldn't help me. I want the behavior, but not the name of the default sourcetypes.

0 Karma

dounla2carlos
Explorer

I am not sure to understand perfectly what you try to do. To me it seems impossible to change de behavior since its linked to a specific set of data. It will always behave as it was doing at the begining
Please if this is not enought, provide more details

0 Karma
Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...