Splunk ships pre-trained to recognize many different source types. A number of source types are automatically recognized, tagged and parsed appropriately. Splunk also contains a significant number of pre-trained source types that are not automatically recognized but can be assigned via SplunkWeb or inputs.conf.
It's a good idea to use a pre-trained source type if it matches your data, as Splunk contains optimized indexing properties for pre-trained source types. However, if your data does not fit with any pre-trained source types, you can Splunk can index virtually any format of data without custom properties.
Aug 24 14:08:05 asterisk[14287]: Manager 'randy' logged on from 127.0.0.1
asterisk_messages
Standard Asterisk messages log (errors and warnings)
Aug 24 14:48:27 WARNING[14287]: Channel 'Zap/1-1' sent into invalid extension 's' in context 'default', but no invalid handler
asterisk_queue
Standard Asterisk queue log
NONE|NONE|NONE|CONFIGRELOAD|
cisco_syslog
Standard Cisco syslog produced by all Cisco network devices including PIX firewalls, routers, ACS, etc., usually via remote syslog to a central log host
Standard Sugarcrm activity log reported using the log4php utility
Fri Aug 5 12:39:55 2005,244 [28666] FATAL layout_utils - Unable to load the application list language file for the selected language(en_us) or the default language(en_us)
weblogic_stdout
Weblogic server log in the standard native BEA format
Standard Websphere system error log in IBM's native tr log format
{{[7/1/05 13:41:00:516 PDT] 000003ae SystemErr R at com.ibm.ws.http.channel. inbound.impl.HttpICLReadCallback.complete _
(HttpICLReadCallback.java(Compiled Code)) _
(truncated)}}||
websphere_trlog_sysout
Standard Websphere system out log in IBM's native trlog format; similar to the log4j server log for Resin and Jboss, sampe format as the system error log but containing lower severity and informational events
