Knowledge Management

What is the purpose of the sourcetype "stash_new"?

lcavaliere_splu
Splunk Employee
Splunk Employee

What is the purpose of the sourcetype "stash_new" as opposed to the "stash sourcetype?

0 Karma

Amandeepsin
New Member

Splunk automatically give this sourcetype. It doesn't cost us license and mentioning this stash it knows that license should not used while indexing summary index

0 Karma

vishaltaneja070
Motivator

Basically it is used when you are doing summary indexing using collect command.
Data first get written to a stash_new file.
After that file processed based on sourcetype stash_new and stash.

lcavaliere_splu
Splunk Employee
Splunk Employee

When incoming summary data is being processed (e.g. from the collect command), the associated sourcetype is initially "stash_new". After the staging of this data is complete, it then is transformed to the sourcetype "stash".

Also of interest, this also means that any setting of TZ done under the "stash" sourcetype will get clobbered in that tranformation. This explains the workaround/solution provided in the following post:
https://answers.splunk.com/answers/717448/why-does-setting-a-tz-for-sourcetype-stash-not-tak.html?mi...

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...