Getting Data In

Defining custom sourcetype based on log file path

Path Finder

We have a forwarder/receiver topology configured here. Each of the 200 or so servers have a light forwarder their info to the main indexer/receiver.

My challenge is that many of these machines are generating a custom source type.

We are currently defining the custom source types in a .conf file at the forwarding machine. unfortunately, this creates somewhat of a management problem given the number of machines.

is there way to define custom source types in .conf at the Receiver/Indexer?

Tags (2)
0 Karma


Are you using Splunk's deployment server to manage forwarder configurations? That should be the best way to solve the issue.

Otherwise, you could use props/transforms stanzas to override the sourcetype assignment at runtime. You could run a regex on the "source" field and assign a predefined sourcetype if the event matches the regex. You can find lots of details here:

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...