Getting Data In

How to get data into splunk?

dani9
Explorer

Hi,

After setted a source by inputs.conf where inside is specified a sourcetype="something" and index="something".

Sources come from by UFs.

So the question: is insert sourcetype into that file inputs.conf enough or do I also have to create sourcetype in the GUI so I mean into settings > sourcetype.

Labels (3)
0 Karma

venkateshparank
Path Finder

Just mentioning the sourcetype in inputs.conf is enough.

0 Karma

wedge22
Explorer

You can specify a new index and sourcetype from the stanza, you do not need to do this again in the GUI. I suggest testing the new data before fully committing to adding it to Splunk. To test just goto the GUI and use the Add Data option and select Index Once vs Continuously Monitor.

0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...