Missing source types

[mhale1982]

I just installed Splunk 5.0.1, and I'm missing the cisco_syslog source, along with a bunch of others.

In fact, when I define a source, my only options are:

• access_combined
• apache_error
• csv
• iis
• log4j
• log4php
• syslog

Any ideas?

[Ayn · Accepted solution]

Out of the box Splunk comes with only a few pre-defined sourcetypes. It's up to you to define your own for other data sources you might have. Support for various log sources is commonly made possible through apps available here on splunkbase - http://splunk-base.splunk.com/apps - and these apps might have various requirements on what sourcetypes you should be using, so check what sourcetypes you need, then use those.

[mhale1982]

Ahhhhhh...gotcha. Dude, that makes no sense. Why would the from-list not have all the options and require you to manually type it in?

Thank you very much for your help...that solved it. 🙂

[Ayn]

That's a list of the sourcetypes there is support for yes - however the list in the manager in the web interface doesn't include them all. I could agree that it would be a good idea to include them instead, but as it stands these are the only ones in the list. It's no problem though to just specify the sourcetype you want yourself instead by choosing "Manual" instead of "From list".

[mhale1982]

That answer is in direct contradiction to this:

http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Listofpretrainedsourcetypes

Your answer meshes what I'm experiencing out of the box, but it contradicts how the software should be behaving, based on the manual.

[lguinn2]

And almost all of the apps are free...