Getting Data In

Where is my props for a certain sourcetype?

danielbb
Motivator

Since we are in early stages of using Splunk cloud, we don't define props.conf as part of the onboarding process, and we introduce props for a certain sourcetype only when parsing goes off. So for a certain sourcetype, line-breaking is off, and when looking for the sourcetype on the indexers (via support) and on the on-prem HF where the data is ingested and I cannot find the props for this sourcetype. So I wonder is it possible to have no sourcetype anywhere for a particular source?

Labels (1)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

1. The best practice is to define as much as you can from the so-called magic eight. It boosts performance on ingestion and lets you avoid errors with line breaking or timestamp recognition.

2. Sourcetype is just a value of metadata associated with an event. From technical point of view it doesn't have to be "defined" anywhere prior to setting given value as sourcetype. You could even create an index-time transform setting a sourcetype to a completely random value and Splunk would still work and process the events (although the effects might be far from desirable). It's the other way around - the value of the sourcetype metadata can - if configured properly - affect how Splunk processes events. BTW, sourcetype is just one of the metadata fields that comes into play when Splunk decides what to do with an event. Other ones are source and host.

Get Updates on the Splunk Community!

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...

Splunk App Dev Community Updates – What’s New and What’s Next

Welcome to your go-to roundup of everything happening in the Splunk App Dev Community! Whether you're building ...

The Latest Cisco Integrations With Splunk Platform!

Join us for an exciting tech talk where we’ll explore the latest integrations in Cisco + Splunk! We’ve ...