First, do NOT edit any file in a 'default' directory or your changes will be lost the next time you upgrade Splunk. See the note at the top of $SPLUNK_HOME/etc/system/default.props.conf. It's better to create a custom apps, myorg_foo_inputs and myorg_foo_props, to hold the config files then install those apps in the appropriate places (search head, indexer, forwarder).
The sourcetype attribute in inputs.conf answers the original question: how to set a source type for a data source. Every unique source type (format) should have a sourcetype attribute and a corresponding stanza in props.conf.
The props.conf stanza tells Splunk how to parse the data of that type. Splunk is pretty good at guessing, but, as you've seen, doesn't always get it right. Use props to prevent Splunk from guessing wrong.
DATE_TIME_CONFIG = current says to use the current time for events since the data does not contain a timestamp.
SHOULD_LINEMERGE = false says not to join lines together.
'LINE_BREAKER = ([\r\n]+)deviceName' tells Splunk events begin when "deviceName" is seen immediately after a newline.
All of these settings are in the docs and in $SPLUNK_HOME/etc/system/README/props.conf.spec.
... View more