Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Re: Using sourcetype in input.conf in Batch mode d...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I noticed that source is not available in the Batch mode unlike the monitor mode. I wonder if the same applies to sourcetypes? It wasn't explicitly mentioned in the docs.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have used sourcetype with batch inputs. Here is an example that works
[batch://myinputdirectory]
move_policy = sinkhole
index = xyz
sourcetype = xyz
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have confirmed this to work in Splunk 5.0.4 build 172409. I will upgrade.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have used sourcetype with batch inputs. Here is an example that works
[batch://myinputdirectory]
move_policy = sinkhole
index = xyz
sourcetype = xyz
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
We upgraded but I believe the fix was from simplifying the transforms.conf. I found I didn't have the exact same environment on my test box. Thanks for you help.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Worked for me in several versions...
Do you have a typo somewhere? You might want to check everything one more time before you upgrade!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ok... that's what I have as well. I will go dig further. I should have listed the build we use. version 5.0.3, build 163460. Thanks for comment.
Accelerating Observability as Code with the Splunk AI Assistant
Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...
Congratulations to the 2025-2026 SplunkTrust!
