Getting Data In

How to add a new sourcetype to an existing index?

shrirangphadke
Path Finder

Hi,

Sorry if my question is repeated.

I have an index with sourcetype as 'firewall' and now I want to add one more sourcetype to the existing index called 'security'.

How do I achieve that? Please help.

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

There is no index level configuration required for a new sourcetype. Just configure your sourcetype in props.conf on Heavy forwarder/Indexers and configure your data inputs to use the existing index and new sourcetype.

dineshraj
Explorer

Just add the new monitor and sourcetype in inputs.conf, it will starting showing the data.

If you want specific processing add configurations in props.conf for the sourcetype..

Get Updates on the Splunk Community!

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...