How can you add additional sourcetypes to the pre-defined sourcetypes, so that way when users add inputs through the GUI, the custom sourcetypes are on the dropdown menu?
The following in props.conf
will do it:
[yoursourcetype]
pulldown_type = true
Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf
The following in props.conf
will do it:
[yoursourcetype]
pulldown_type = true
Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf
pulldown_type = true
this is already a part of props.conf
Guessing here, but it probably enough to restart of SplunkWeb. Restarting splunkd seems unnecessary.
not sure if it's required but I had to restart my Splunk instance, but this worked!