Getting Data In

Custom name for Sourcetype

ghannemann
Engager

Hi

I have a forwarder pushing java log data to an indexer. The inputs on the index was set to log4j. However in the basic summary screen, the sourcetype is shown as server.
Why is this?

Is there anyway to rename this sourcetype, or creating based on an existing one with a different name?

Regards,
Gerhard

Tags (1)
0 Karma

ghannemann
Engager

Whoops, sorry, yes I did mean sourcetype, not index, (had other questions that - mix up of terms). I was trying to see if I could create my own sourcetypes based on existing ones.

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

You can specify the sourcetype in a few places.

On the forwarder, in inputs.conf:

[monitor://path to log file]
sourcetype=log4j

OR

On the indexer, in props.conf:

[source::full path to log file]
sourcetype=log4j
0 Karma

ghannemann
Engager

Thank you.
I also found it useful to set sourcetype on the forward (universal forwarder) and the receiver as well.

0 Karma

sbrant_splunk
Splunk Employee
Splunk Employee

Your description is a bit confusing. You say that "the inputs on the index was set to log4j", do you mean that the inputs.conf file on the forwarder, within the stanza collecting this file, has a line that says "sourcetype=log4j"?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...