Getting Data In

How to add a new sourcetype to an existing index?

shrirangphadke
Path Finder

Hi,

Sorry if my question is repeated.

I have an index with sourcetype as 'firewall' and now I want to add one more sourcetype to the existing index called 'security'.

How do I achieve that? Please help.

Tags (2)
0 Karma

somesoni2
Revered Legend

There is no index level configuration required for a new sourcetype. Just configure your sourcetype in props.conf on Heavy forwarder/Indexers and configure your data inputs to use the existing index and new sourcetype.

dineshraj
Explorer

Just add the new monitor and sourcetype in inputs.conf, it will starting showing the data.

If you want specific processing add configurations in props.conf for the sourcetype..

Get Updates on the Splunk Community!

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...

Avoid Certificate Expiry Issues in Splunk Enterprise with Certificate Assist

This blog post is part 2 of 4 of a series on Splunk Assist. Click the links below to see the other ...