creating automatic sourcetype

[smolcj]

hi,
how to create an automatic sourcetype, which is not there in the splunk list ?
how we can define the regex so that automatically splunk identifies the sourcetype and index.
pls help
thanks

[MuS]

hi smolcj

since sourcetypes for log events are created at index time, you should have a look at docs about props and transforms for a start.

cheers,

MuS