Getting Data In

How do you add sourcetypes to the pre-defined sourcetypes

BunnyHop
Contributor

How can you add additional sourcetypes to the pre-defined sourcetypes, so that way when users add inputs through the GUI, the custom sourcetypes are on the dropdown menu?

Tags (1)
1 Solution

southeringtonp
Motivator

The following in props.conf will do it:

[yoursourcetype]
pulldown_type = true

Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf

View solution in original post

southeringtonp
Motivator

The following in props.conf will do it:

[yoursourcetype]
pulldown_type = true

Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf

View solution in original post

bhupinder_singh
Explorer

pulldown_type = true
this is already a part of props.conf

0 Karma

southeringtonp
Motivator

Guessing here, but it probably enough to restart of SplunkWeb. Restarting splunkd seems unnecessary.

0 Karma

BunnyHop
Contributor

not sure if it's required but I had to restart my Splunk instance, but this worked!

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!