Getting Data In

Source vs Sourcetype: What's the difference?

test_qweqwe
Builder

Source - The source of an event is the name of the file, stream, or other input from which the event originates
1) Which are the sources of the event?Simulate me some real situations.

Sourcetype - The source type of an event is the format of the data input from which it originates like for windows .evt files from event viewer
1) Which are the sources type of the event? The same question.

I can not understand what applies to source and to sourcetype.
I would be glad if somebody gives examples. Or what should I read to better understand logs? I understand that there are just different logs. Some are responsible for one, the other for the other.

1 Solution

inventsekar
SplunkTrust
SplunkTrust

1) Which are the sources of the event?Simulate me some real situations.
event source can be anything. a system log file, an app log files, lookup files, etc..

2) Which are the sources type of the event? The same question. --- the type of the sources will be the sourcetype.

for example, you can add data from /var/log/messages to splunk.
for this data,

source=/var/log/messages 
and 
sourcetype=linux_syslog

Source vs sourcetype -
Source and source type are both default fields, but they are entirely different otherwise, and can be easily confused.

The source is the name of the file, stream, or other input from which a particular event originates.
The sourcetype determines how Splunk software processes the incoming data stream into individual events according to the nature of the data.
Events with the same source type can come from different sources, for example, if you monitor source=/var/log/messages and receive direct syslog input from udp:514. If you search sourcetype=linux_syslog, events from both of those sources are returned.

http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Aboutdefaultfields

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !

View solution in original post

HiroshiSatoh
Champion

The source is the entity of the log

Source type is log classification
Classification is used variously by users.
· Classification by format
· Classified by service and system
· Classified by character code
· etc

inventsekar
SplunkTrust
SplunkTrust

1) Which are the sources of the event?Simulate me some real situations.
event source can be anything. a system log file, an app log files, lookup files, etc..

2) Which are the sources type of the event? The same question. --- the type of the sources will be the sourcetype.

for example, you can add data from /var/log/messages to splunk.
for this data,

source=/var/log/messages 
and 
sourcetype=linux_syslog

Source vs sourcetype -
Source and source type are both default fields, but they are entirely different otherwise, and can be easily confused.

The source is the name of the file, stream, or other input from which a particular event originates.
The sourcetype determines how Splunk software processes the incoming data stream into individual events according to the nature of the data.
Events with the same source type can come from different sources, for example, if you monitor source=/var/log/messages and receive direct syslog input from udp:514. If you search sourcetype=linux_syslog, events from both of those sources are returned.

http://docs.splunk.com/Documentation/Splunk/7.0.0/Data/Aboutdefaultfields

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Can’t Make It to Boston? Stream .conf25 and Learn with Haya Husain

Boston may be buzzing this September with Splunk University and .conf25, but you don’t have to pack a bag to ...

Splunk Lantern’s Guide to The Most Popular .conf25 Sessions

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Unlock What’s Next: The Splunk Cloud Platform at .conf25

In just a few days, Boston will be buzzing as the Splunk team and thousands of community members come together ...