Getting Data In

How can I define customize sourcetype that I write logs in _internal?

sathiyasun
Explorer

My custom script writes log in /opt/splunk/var/log/splunk/script.log.

I want the log to be indexed in _internal but have to define a customized sourcetype for the log to write in a proper linebreak. Please let me know how to define sourcetype for the _internal data.

0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

In your inputs.conf file, add:

[monitor:///opt/splunk/var/log/splunk/script.log]
sourcetype = foo
index = _internal

In your props,conf file, add the following. Adjust the values to match your data.

[foo]
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = ^
TIME_FORMAT = %m/%d/%Y %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 10000
SHOULD_LINEMERGE = false
---
If this reply helps you, Karma would be appreciated.

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

In your inputs.conf file, add:

[monitor:///opt/splunk/var/log/splunk/script.log]
sourcetype = foo
index = _internal

In your props,conf file, add the following. Adjust the values to match your data.

[foo]
LINE_BREAKER = ([\r\n]+)
TIME_PREFIX = ^
TIME_FORMAT = %m/%d/%Y %H:%M:%S
MAX_TIMESTAMP_LOOKAHEAD = 30
TRUNCATE = 10000
SHOULD_LINEMERGE = false
---
If this reply helps you, Karma would be appreciated.
0 Karma

sathiyasun
Explorer

Thanks it works!!!

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...