Getting Data In

Is there a list that contains all the possible values for "eai:type" field in the REST endpoint: services/data/inputs/all

Path Finder

Hi,

When I go to :8089/services/data/inputs/all I get a list of all the inputs Splunk is listening to. In each input there is a field called eai:type. Is there a list that contains all the possible values eai:type can have? So far I have seen monitor and WinEventLog.

Thanks.

0 Karma
1 Solution

Esteemed Legend

Those are not sourctypes but they are input types that are related to sourcetypes. Sourcetypes can be anything (almost). This is the closest thing that exists to a master list of sourcetypes:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes

The master list of inputs, more or less, can be found here: $SPLUNK_HOME/etc/system/README/inputs.conf.spec

But keep in mind, that adding apps can cause more inputs to be available (e.g. the ServiceNow stuff will add a "snow" input type).
So try this:

find $SPLUNK_HOME -name inputs.conf.spec

Read up on it all.

View solution in original post

Esteemed Legend

Those are not sourctypes but they are input types that are related to sourcetypes. Sourcetypes can be anything (almost). This is the closest thing that exists to a master list of sourcetypes:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Listofpretrainedsourcetypes

The master list of inputs, more or less, can be found here: $SPLUNK_HOME/etc/system/README/inputs.conf.spec

But keep in mind, that adding apps can cause more inputs to be available (e.g. the ServiceNow stuff will add a "snow" input type).
So try this:

find $SPLUNK_HOME -name inputs.conf.spec

Read up on it all.

View solution in original post

Explorer

Regarding TA's that created Input types, like Splunk TA for AWS...
...and when installed to a SplunkCloud instance, I see a different count between the UI (10 - enabled) and | rest /services/data/inputs/all (7)

Is that a ticket to splunkCloud Ops or is there something you're aware of that "hides" some inputs from the rest api?

0 Karma

SplunkTrust
SplunkTrust

Those look like sourcetypes. If so, it could be anything an admin defines.

0 Karma