Getting Data In

How do you add sourcetypes to the pre-defined sourcetypes

BunnyHop
Contributor

How can you add additional sourcetypes to the pre-defined sourcetypes, so that way when users add inputs through the GUI, the custom sourcetypes are on the dropdown menu?

Tags (1)
1 Solution

southeringtonp
Motivator

The following in props.conf will do it:

[yoursourcetype]
pulldown_type = true

Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf

View solution in original post

southeringtonp
Motivator

The following in props.conf will do it:

[yoursourcetype]
pulldown_type = true

Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf

bhupinder_singh
Explorer

pulldown_type = true
this is already a part of props.conf

0 Karma

southeringtonp
Motivator

Guessing here, but it probably enough to restart of SplunkWeb. Restarting splunkd seems unnecessary.

0 Karma

BunnyHop
Contributor

not sure if it's required but I had to restart my Splunk instance, but this worked!

0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>