Getting Data In

Missing source types

mhale1982
Path Finder

I just installed Splunk 5.0.1, and I'm missing the cisco_syslog source, along with a bunch of others.

In fact, when I define a source, my only options are:

  • access_combined
  • apache_error
  • csv
  • iis
  • log4j
  • log4php
  • syslog

Any ideas?

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Out of the box Splunk comes with only a few pre-defined sourcetypes. It's up to you to define your own for other data sources you might have. Support for various log sources is commonly made possible through apps available here on splunkbase - http://splunk-base.splunk.com/apps - and these apps might have various requirements on what sourcetypes you should be using, so check what sourcetypes you need, then use those.

View solution in original post

Ayn
Legend

Out of the box Splunk comes with only a few pre-defined sourcetypes. It's up to you to define your own for other data sources you might have. Support for various log sources is commonly made possible through apps available here on splunkbase - http://splunk-base.splunk.com/apps - and these apps might have various requirements on what sourcetypes you should be using, so check what sourcetypes you need, then use those.

mhale1982
Path Finder

Ahhhhhh...gotcha. Dude, that makes no sense. Why would the from-list not have all the options and require you to manually type it in?

Thank you very much for your help...that solved it. 🙂

0 Karma

Ayn
Legend

That's a list of the sourcetypes there is support for yes - however the list in the manager in the web interface doesn't include them all. I could agree that it would be a good idea to include them instead, but as it stands these are the only ones in the list. It's no problem though to just specify the sourcetype you want yourself instead by choosing "Manual" instead of "From list".

0 Karma

mhale1982
Path Finder

That answer is in direct contradiction to this:

http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Listofpretrainedsourcetypes

Your answer meshes what I'm experiencing out of the box, but it contradicts how the software should be behaving, based on the manual.

0 Karma

lguinn2
Legend

And almost all of the apps are free...

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...