Dynamic sourcetype setup

[henry_ty_leung]

Hi There,

Just wondering whether it is possible to define ONE sourcetype for below csv log files.
So that we do not need to append into the same csv file (i.e it's already over 8GBs now) for source referencing...

i.e \\10.252.25.81\Splunk\henry\website_*.csv

E.g.

\\10.252.25.81\Splunk\henry\website_20141215.csv
\\10.252.25.81\Splunk\henry\website_20141216.csv
\\10.252.25.81\Splunk\henry\website_20141217.csv
\\10.252.25.81\Splunk\henry\website_201412....csv

....etc

[MuS]

Hi henry_ty_leung,

sure, take a look at the docs http://docs.splunk.com/Documentation/Splunk/6.2.0/admin/Inputsconf where you can learn how to set a sourcetype for an input:

sourcetype = <string>
* Sets the sourcetype key/field for events from this input.

cheers, MuS