Getting Data In

Edit manually created Source types


I recently added a log file to be monitored. It required me to define a custom source type in order to parse it. I noticed that my RegEx was not well defined and needed to be modified. I can find no way to modify my custom source type, or even delete it for that matter. How do I edit it?

Tags (3)

Re: Edit manually created Source types


You will have to change the configuration file of splunk.

Name of the file : "props.conf"
Location (Recommended) : $SPLUNK_DIR\etc\system\local\

Any new sourcetype you had created would have an entry similar to this

pulldown_type = 1

Edit wherever you want it to, and you can create new sourcetypes here as well.

Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf