Getting Data In

Where can I find my sourcetype definitions?

johnstetter
Explorer

It's my understanding that sourcetypes are defined in props.conf and potentially transforms.conf.

We have a sourcetype that is active and searchable (sourcetype=netappAuditlog), yet i cannot find the actual source type defined anywhere in those 2 files - on either the search heads (configured in a pool), or on the indexers. Is there a way to craft a search to determine where a sourcetype is defined?

Any help or advice would be greatly appreciated.

Tags (1)
0 Karma
1 Solution

kristian_kolb
Ultra Champion

The sourcetype can be defined in either

  • inputs.conf (typically on the forwarder side) if you do not set it explicitly, splunk will set one for you.
  • props.conf (indexer side)
  • transforms.conf (indexer side)

you should probably check out /opt/splunk/etc/apps/learned/local to see if an auto-assigned sourcetype has been created there.

The search heads have nothing to do with it.

/k

View solution in original post

kristian_kolb
Ultra Champion

The sourcetype can be defined in either

  • inputs.conf (typically on the forwarder side) if you do not set it explicitly, splunk will set one for you.
  • props.conf (indexer side)
  • transforms.conf (indexer side)

you should probably check out /opt/splunk/etc/apps/learned/local to see if an auto-assigned sourcetype has been created there.

The search heads have nothing to do with it.

/k

somesoni2
SplunkTrust
SplunkTrust

Sourcetypes are indeed defined on props.conf (mostly). I don't think there is a direct search available to see the definitions of it, but your can browse the props.conf file present in default/local folders of "etc/system" or "etc/apps/"

0 Karma

linu1988
Champion

props and transforms.conf they define the sourcetype behavior if the user wants to field extraction/filter/parse it. But i doesn't contain the definition if not required. It is just a alias for the source you want to assign from forwarder or any inputs. So what you see is the name itself given to the netappAuditlog source.

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...