Getting Data In

How to get data into splunk?

Explorer

Hi,

After setted a source by inputs.conf where inside is specified a sourcetype="something" and index="something".

Sources come from by UFs.

So the question: is insert sourcetype into that file inputs.conf enough or do I also have to create sourcetype in the GUI so I mean into settings > sourcetype.

Labels (3)
0 Karma

Path Finder

Just mentioning the sourcetype in inputs.conf is enough.

0 Karma

Explorer

You can specify a new index and sourcetype from the stanza, you do not need to do this again in the GUI. I suggest testing the new data before fully committing to adding it to Splunk. To test just goto the GUI and use the Add Data option and select Index Once vs Continuously Monitor.

0 Karma