How to get data into splunk?

[dani9]

Hi,

After setted a source by inputs.conf where inside is specified a sourcetype="something" and index="something".

Sources come from by UFs.

So the question: is insert sourcetype into that file inputs.conf enough or do I also have to create sourcetype in the GUI so I mean into settings > sourcetype.

[venkateshparank]

Just mentioning the sourcetype in inputs.conf is enough.

[wedge22]

You can specify a new index and sourcetype from the stanza, you do not need to do this again in the GUI. I suggest testing the new data before fully committing to adding it to Splunk. To test just goto the GUI and use the Add Data option and select Index Once vs Continuously Monitor.