It's my understanding that sourcetypes are defined in props.conf and potentially transforms.conf.
We have a sourcetype that is active and searchable (sourcetype=netappAuditlog), yet i cannot find the actual source type defined anywhere in those 2 files - on either the search heads (configured in a pool), or on the indexers. Is there a way to craft a search to determine where a sourcetype is defined?
Any help or advice would be greatly appreciated.
The sourcetype can be defined in either
you should probably check out /opt/splunk/etc/apps/learned/local to see if an auto-assigned sourcetype has been created there.
The search heads have nothing to do with it.
/k
The sourcetype can be defined in either
you should probably check out /opt/splunk/etc/apps/learned/local to see if an auto-assigned sourcetype has been created there.
The search heads have nothing to do with it.
/k
Sourcetypes are indeed defined on props.conf (mostly). I don't think there is a direct search available to see the definitions of it, but your can browse the props.conf file present in default/local folders of "etc/system" or "etc/apps/
props and transforms.conf they define the sourcetype behavior if the user wants to field extraction/filter/parse it. But i doesn't contain the definition if not required. It is just a alias for the source you want to assign from forwarder or any inputs. So what you see is the name itself given to the netappAuditlog source.