Getting Data In

Dynamic sourcetype setup

henry_ty_leung
Explorer

Hi There,

Just wondering whether it is possible to define ONE sourcetype for below csv log files.
So that we do not need to append into the same csv file (i.e it's already over 8GBs now) for source referencing...

i.e \\10.252.25.81\Splunk\henry\website_*.csv

E.g.

\\10.252.25.81\Splunk\henry\website_20141215.csv
\\10.252.25.81\Splunk\henry\website_20141216.csv
\\10.252.25.81\Splunk\henry\website_20141217.csv
\\10.252.25.81\Splunk\henry\website_201412....csv

....etc

0 Karma

MuS
SplunkTrust
SplunkTrust

Hi henry_ty_leung,

sure, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Inputsconf where you can learn how to set a sourcetype for an input:

sourcetype = <string>
* Sets the sourcetype key/field for events from this input.

cheers, MuS

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.