Getting Data In

Edit manually created Source types


I recently added a log file to be monitored. It required me to define a custom source type in order to parse it. I noticed that my RegEx was not well defined and needed to be modified. I can find no way to modify my custom source type, or even delete it for that matter. How do I edit it?

Tags (3)


You will have to change the configuration file of splunk.

Name of the file : "props.conf"
Location (Recommended) : $SPLUNK_DIR\etc\system\local\

Any new sourcetype you had created would have an entry similar to this

pulldown_type = 1

Edit wherever you want it to, and you can create new sourcetypes here as well.

Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf

Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.