Getting Data In

Dynamic sourcetype setup

henry_ty_leung
Explorer

Hi There,

Just wondering whether it is possible to define ONE sourcetype for below csv log files.
So that we do not need to append into the same csv file (i.e it's already over 8GBs now) for source referencing...

i.e \\10.252.25.81\Splunk\henry\website_*.csv

E.g.

\\10.252.25.81\Splunk\henry\website_20141215.csv
\\10.252.25.81\Splunk\henry\website_20141216.csv
\\10.252.25.81\Splunk\henry\website_20141217.csv
\\10.252.25.81\Splunk\henry\website_201412....csv

....etc

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi henry_ty_leung,

sure, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Inputsconf where you can learn how to set a sourcetype for an input:

sourcetype = <string>
* Sets the sourcetype key/field for events from this input.

cheers, MuS

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!