How to know sourcetype defined

[Ash1]

I have some logs coming into splunk and there are parsing correctly without any issues

Index= xxx sourcetype=splunk-logs

But now the logs time zone changed now i have to update the time zone in props.conf

So where can I find this existing sourcetype=splunk-logs in splunk

[richgalloway · Accepted solution]

Use btool

splunk btool --debug props list splunk-logs

It will display all of the props for the sourcetype along with the file name in which the prop is defined.

Remember, never change $SPLUNK_HOME/etc/system/default/props.conf and change $SPLUNK_HOME/etc/apps/*/default/props.conf only if it's your app.  Otherwise, put the change in local/props.conf.