Getting Data In
Highlighted

What is this 'Learned' file under apps?

Path Finder

I was just poking around to find out why my data had this strange sourcetype history-y2016-m06-d-10, and when I went to C:\Program Files\SplunkUniversalForwarder\etc\apps\learned\local, I found a props.conf and sourcetypes.conf. It's like it has been recording what I have it reading from inputs.conf? What are these files generated for?

Tags (3)
0 Karma
Highlighted

Re: What is this 'Learned' file under apps?

Splunk Employee
Splunk Employee

This is the learned app, it is unique to each instance, and dynamically populated.
Where splunk store automatic sourcetypes (for each file that was monitored without specifying a sourcetype)

see the very last remark of this page :
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Whysourcetypesmatter

View solution in original post

Highlighted

Re: What is this 'Learned' file under apps?

Path Finder

Thanks! That explains it well.

0 Karma
Highlighted

Re: What is this 'Learned' file under apps?

Path Finder

If we have too many sourcetypes, say around in 1600 in props.conf, does it affects the indexing & search performance ? If yes, it would be great if you could help me understand the logic behind it .

Thanks in Advance !!

0 Karma