Getting Data In

Edit manually created Source types

rhansen
Explorer

I recently added a log file to be monitored. It required me to define a custom source type in order to parse it. I noticed that my RegEx was not well defined and needed to be modified. I can find no way to modify my custom source type, or even delete it for that matter. How do I edit it?

Tags (3)

rishiehari
Explorer

You will have to change the configuration file of splunk.

Name of the file : "props.conf"
Location (Recommended) : $SPLUNK_DIR\etc\system\local\

Any new sourcetype you had created would have an entry similar to this

[config]
NO_BINARY_CHECK =1
pulldown_type = 1
SHOULD_LINEMERGE = true

Edit wherever you want it to, and you can create new sourcetypes here as well.

Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!