Getting Data In

how to identify sourcetype forbetter parsing

krutika_ag
Engager

I need help in understanding that what sourcetype would be ideal to parse logs of this File type

krutika_ag_1-1710342055829.png

 

Tags (3)
0 Karma

isoutamo
SplunkTrust
SplunkTrust
Hi
Usually you will get some hints about product by looking the directory hierarchy and names on it.
r. Ismo
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @krutika_ag,

you should know where these logs come from, or at least what system produced them.

If not, you could try using the Splunk automatic recognition but I don't like this solution because the error margin is very large.

You could open the files and take some strings to search on internet what could be the technologu that produced them and then you could search the relative sourcetype.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...