How does Splunk find sourcetypes?

aapittts · ‎02-12-2013

I have several instances of SplunkforBlueCoat and have recently run into a strange issue. Splunk cannot find the BlueCoat sourcetype. I haven't had this issue before and I've checked my props.conf & transforms.conf with correct ones and cannot find any differences. Can anyone point me in the right direction?

yannK · ‎02-12-2013

check the inputs.conf, this is where you specify which sourcetype to apply to which source.

aapittts · ‎02-12-2013

I'm not seeing where in the inputs.conf the source type is defined.

aapittts · ‎02-12-2013

should there be an inputs.conf in the default or local directories of Splunk for Blue Coat?

How does Splunk find sourcetypes?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF

Join the Conversation

How does Splunk find sourcetypes?

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Forwarder Topology Guidance: Intermediate HF vs Intermediate UF