Getting Data In

How to add a new sourcetype to an existing index?

shrirangphadke
Path Finder

Hi,

Sorry if my question is repeated.

I have an index with sourcetype as 'firewall' and now I want to add one more sourcetype to the existing index called 'security'.

How do I achieve that? Please help.

Tags (2)
0 Karma

somesoni2
Revered Legend

There is no index level configuration required for a new sourcetype. Just configure your sourcetype in props.conf on Heavy forwarder/Indexers and configure your data inputs to use the existing index and new sourcetype.

dineshraj
Explorer

Just add the new monitor and sourcetype in inputs.conf, it will starting showing the data.

If you want specific processing add configurations in props.conf for the sourcetype..

Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...