Getting Data

[akankshayadav]

Hi,
I have a folder which has .csv .list .sps .param types of files and I need to index them through inputs.conf. What should i provide in my sourcetype?

[gcusello]

Hi @akankshayadav,

my hint is to load in a test instance (or index) each kind of file, one by one, to find the correct sourcetype to use, to do this you can use the [Settings -- Add data] guided load interface.

You could also leave Splunk to recognize the sourcetypes, but I don't like, I prefer to maintain more control  creating a custom sourcetype for each kind of file.

Then in input.conf you can create a stanza for each kind of file, selecting the source (e.g. csv), the index and the related sourcetype.

Ciao.

Giuseppe

[venkatasri]

@akankshayadav sourcetypes are the names given to data depends on what it is. There are default sourcetypes if they are json, apache access log etc.

If your files are custom data type you can set your own names.

Like - csvdata , your inputs.conf as follows there are additonal fields that you can set like host=<your_host>. I Refer - https://docs.splunk.com/Documentation/SplunkCloud/8.2.2105/Data/Whysourcetypesmatter

[monitor://<path>]
sourcetype=<sourcetype>

---

An upvote would be appreciated and Accept solution if it helps!