Getting Data In

How to set default values for new sourcetypes?

dougmartin
Path Finder

How can I set up several sourcetypes to inherit the values from one place so I don't have to edit 10 different ones that all have the same basic framework?

0 Karma

pradeepkumarg
Influencer

Does all of your sourcetypes follow a specific naming convention? If so, can you wild card them so that you have just one stanza?

Look at this thread
https://answers.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-props-conf-sta...

0 Karma

jkat54
SplunkTrust
SplunkTrust

that's a perfectly acceptable answer, converted to answer.

0 Karma
Get Updates on the Splunk Community!

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...

Enterprise Security (ES) Essentials 8.3 is Now GA — Smarter Detections, Faster ...

As of today, Enterprise Security (ES) Essentials 8.3 is now generally available, helping SOC teams simplify ...