Getting Data In

Edit manually created Source types

rhansen
Explorer

I recently added a log file to be monitored. It required me to define a custom source type in order to parse it. I noticed that my RegEx was not well defined and needed to be modified. I can find no way to modify my custom source type, or even delete it for that matter. How do I edit it?

Tags (3)

rishiehari
Explorer

You will have to change the configuration file of splunk.

Name of the file : "props.conf"
Location (Recommended) : $SPLUNK_DIR\etc\system\local\

Any new sourcetype you had created would have an entry similar to this

[config]
NO_BINARY_CHECK =1
pulldown_type = 1
SHOULD_LINEMERGE = true

Edit wherever you want it to, and you can create new sourcetypes here as well.

Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...