Turns out the required approach was different from what I had imagined, and in fact rather simpler. What I needed to do was: 1. Load my data file (in this case a sample log file) 2. Set up my index: curl -k -u <user>:<password> https://localhost:8089/servicesNS/admin/search/data/indexes -d name=<index-name> 3. Monitor the log directory, assigning to it the required source type: curl -k -u <user>:<password> https://localhost:8089/servicesNS/nobody/search/data/inputs/monitor -d name="/path/to/my/logs" -d index=<index-name> -d host=<host-name> -d sourcetype=<required-source-type> All events from that source will be assigned the required source type. ... View more