Knowledge Management

What is the purpose of the sourcetype "stash_new"?

lcavaliere_splu
Splunk Employee
Splunk Employee

What is the purpose of the sourcetype "stash_new" as opposed to the "stash sourcetype?

0 Karma

Amandeepsin
New Member

Splunk automatically give this sourcetype. It doesn't cost us license and mentioning this stash it knows that license should not used while indexing summary index

0 Karma

vishaltaneja070
Motivator

Basically it is used when you are doing summary indexing using collect command.
Data first get written to a stash_new file.
After that file processed based on sourcetype stash_new and stash.

lcavaliere_splu
Splunk Employee
Splunk Employee

When incoming summary data is being processed (e.g. from the collect command), the associated sourcetype is initially "stash_new". After the staging of this data is complete, it then is transformed to the sourcetype "stash".

Also of interest, this also means that any setting of TZ done under the "stash" sourcetype will get clobbered in that tranformation. This explains the workaround/solution provided in the following post:
https://answers.splunk.com/answers/717448/why-does-setting-a-tz-for-sourcetype-stash-not-tak.html?mi...

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...