Getting Data In

How to add a new sourcetype to an existing index?

shrirangphadke
Path Finder

Hi,

Sorry if my question is repeated.

I have an index with sourcetype as 'firewall' and now I want to add one more sourcetype to the existing index called 'security'.

How do I achieve that? Please help.

Tags (2)
0 Karma

somesoni2
SplunkTrust
SplunkTrust

There is no index level configuration required for a new sourcetype. Just configure your sourcetype in props.conf on Heavy forwarder/Indexers and configure your data inputs to use the existing index and new sourcetype.

dineshraj
Explorer

Just add the new monitor and sourcetype in inputs.conf, it will starting showing the data.

If you want specific processing add configurations in props.conf for the sourcetype..

Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...