Getting Data In

How to set default values for new sourcetypes?

Path Finder

How can I set up several sourcetypes to inherit the values from one place so I don't have to edit 10 different ones that all have the same basic framework?

0 Karma

Influencer

Does all of your sourcetypes follow a specific naming convention? If so, can you wild card them so that you have just one stanza?

Look at this thread
https://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-sta...

0 Karma

SplunkTrust
SplunkTrust

that's a perfectly acceptable answer, converted to answer.

0 Karma