Getting Data In

Sourcetype based on file name


I already have sourcetypes defined for my data I am just confused as to set the source type based on the file name. Splunk monitors one folder that holds all different type of logs and i want it to automatically set the sourcetype based on the file name. For example one of the files has "nokia" (without quotes)in it. It isnt always in the same spot of the file name but it does show up at some point in every file name. How do i configure props and transforms to look for the word "nokia" and set its sourcetype to netx_nokia. Thanks in advance guys.

Tags (1)
1 Solution

Revered Legend
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...