Where can I find my sourcetype definitions?

[johnstetter]

It's my understanding that sourcetypes are defined in props.conf and potentially transforms.conf.

We have a sourcetype that is active and searchable (sourcetype=netappAuditlog), yet i cannot find the actual source type defined anywhere in those 2 files - on either the search heads (configured in a pool), or on the indexers. Is there a way to craft a search to determine where a sourcetype is defined?

Any help or advice would be greatly appreciated.

[kristian_kolb · Accepted solution]

The sourcetype can be defined in either

• inputs.conf (typically on the forwarder side) if you do not set it explicitly, splunk will set one for you.
• props.conf (indexer side)
• transforms.conf (indexer side)

you should probably check out /opt/splunk/etc/apps/learned/local to see if an auto-assigned sourcetype has been created there.

The search heads have nothing to do with it.

/k

[somesoni2]

Sourcetypes are indeed defined on props.conf (mostly). I don't think there is a direct search available to see the definitions of it, but your can browse the props.conf file present in default/local folders of "etc/system" or "etc/apps/"

[linu1988]

props and transforms.conf they define the sourcetype behavior if the user wants to field extraction/filter/parse it. But i doesn't contain the definition if not required. It is just a alias for the source you want to assign from forwarder or any inputs. So what you see is the name itself given to the netappAuditlog source.