What is this 'Learned' file under apps?

[nce054]

I was just poking around to find out why my data had this strange sourcetype history-y2016-m06-d-10, and when I went to C:\Program Files\SplunkUniversalForwarder\etc\apps\learned\local, I found a props.conf and sourcetypes.conf. It's like it has been recording what I have it reading from inputs.conf? What are these files generated for?

[yannK · Accepted solution]

This is the learned app, it is unique to each instance, and dynamically populated.
Where splunk store automatic sourcetypes (for each file that was monitored without specifying a sourcetype)

see the very last remark of this page :
http://docs.splunk.com/Documentation/Splunk/6.2.3/Data/Whysourcetypesmatter

[nce054]

Thanks! That explains it well.

[abhinav_maxonic]

If we have too many sourcetypes, say around in 1600 in props.conf, does it affects the indexing & search performance ? If yes, it would be great if you could help me understand the logic behind it .

Thanks in Advance !!