Getting Data In

Custom name for Sourcetype

Engager

Hi

I have a forwarder pushing java log data to an indexer. The inputs on the index was set to log4j. However in the basic summary screen, the sourcetype is shown as server.
Why is this?

Is there anyway to rename this sourcetype, or creating based on an existing one with a different name?

Regards,
Gerhard

Tags (1)
0 Karma

Engager

Whoops, sorry, yes I did mean sourcetype, not index, (had other questions that - mix up of terms). I was trying to see if I could create my own sourcetypes based on existing ones.

0 Karma

Splunk Employee
Splunk Employee

You can specify the sourcetype in a few places.

On the forwarder, in inputs.conf:

[monitor://path to log file]
sourcetype=log4j

OR

On the indexer, in props.conf:

[source::full path to log file]
sourcetype=log4j
0 Karma

Engager

Thank you.
I also found it useful to set sourcetype on the forward (universal forwarder) and the receiver as well.

0 Karma

Splunk Employee
Splunk Employee

Your description is a bit confusing. You say that "the inputs on the index was set to log4j", do you mean that the inputs.conf file on the forwarder, within the stanza collecting this file, has a line that says "sourcetype=log4j"?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!