Splunk Search

Splunk for Unix Sourcetypes for syslog

daniel333
Builder

All,

I am looking at Splunk for Unix TA. I see the /var/log/messages input and for the life of me I can't find in this app where it's getting it's sourcetype of "syslog". Skimmed props.conf on the TA (why does the TA have a props?) and the splunk_for_unix_app too.

[monitor:///var/log]
whitelist=(\.log|log$|messages|secure|auth|mesg$|cron$|acpid$|\.out)
blacklist=(lastlog|anaconda\.syslog)
index=os
disabled = 1
0 Karma

ddrillic
Ultra Champion

syslog belongs to a set of predefined source types - What are the default sourcetypes and how are they determined?

The "official" documentation about them at Why source types matter

inventsekar
SplunkTrust
SplunkTrust

Hi Daniel,
This page is listing all the source types from Splunk App for Unix -
http://docs.splunk.com/Documentation/UnixAddOn/5.2.3/User/SourcetypesandCIMdatamodelinfo

why does the TA have a props?
Splunk has config files for separately for "global and app/user contexts", so that maintenance would become easy and simple.
when the number of users and apps grow, these global and app/user contexts help in administration duties.

thanks and best regards,
Sekar

PS - If this or any post helped you in any way, pls consider upvoting, thanks for reading !
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...