Getting Data In

sourcetypes

jonathan_lam
Explorer

We have forwarders sending data to our dedicated indexers. Do we need to set up custom sourcetypes on the forwarders or the indexers?

Please point me to documentation if this exists. Thank you!

Tags (1)
0 Karma

jbsplunk
Splunk Employee
Splunk Employee

It depends on the kind of forwarder and the type of configuration. You can set sourcetype in inputs.conf and it would be respected for the life of an event with no problem.

http://docs.splunk.com/Documentation/Splunk/latest/admin/inputsconf

If setting it in an input isn't possible, because maybe you want multiple sourcetypes from the same input, then its another story. Universal and Lightweight forwarders do not do parsing, so if you're using those, you'd put your changes on the Indexer. If your using a heavy forwarder, you can put your changes there as data would be parsed by the time it left the output queue.

http://wiki.splunk.com/Where_do_I_configure_my_Splunk_settings%3F

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...