sourcetypes.conf

sourcetypes.conf

sourcetypes.conf.spec

# Copyright (C) 2005-2008 Splunk Inc. All Rights Reserved. Version 3.2
#
# NOTE: sourcetypes.conf is a machine-generated file that stores the document models used by the 
# file classifier for creating source types.
# Generally, you should not edit sourcetypes.conf, as most attributes are machine generated.
# However, there are two attributes which you can change.
#
# There is a sourcetypes.conf in $SPLUNK_HOME/etc/system/default/ To set custom 
# configurations, place a sourcetypes..conf in $SPLUNK_HOME/etc/system/local/. 
# For examples, see sourcetypes.conf.example. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
_sourcetype = <value>
        * Specifies the sourcetype for the model.
        * Change this to change the model's sourcetype.
        * Future sources that match the model will receive a sourcetype of this new name.
_source = <value>
        * Specifies the source (filename) for the model.

sourcetypes.conf.example

# Copyright (C) 2005-2008 Splunk Inc.  All Rights Reserved.  Version 3.0 
#
# This file contains an example sourcetypes.conf.  Use this file to configure sourcetype models.
#
# NOTE: sourcetypes.conf is a machine-generated file that stores the document models used by the 
# file classifier for creating source types.
#
# Generally, you should not edit sourcetypes.conf, as most attributes are machine generated.
# However, there are two attributes which you can change.
#
# To use one or more of these configurations, copy the configuration block into
# sourcetypes.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk to enable configurations.
#
# To learn more about configuration files (including precedence) please see the documentation 
# located at http://www.splunk.com/base/Documentation/latest/Admin/HowDoConfigurationFilesWork.
#
# This is an example of a machine-generated sourcetype models for a fictitious sourcetype cadcamlog.
#
[/Users/bob/logs/bnf.x5_Thu_Dec_13_15:59:06_2007_171714722]
_source = /Users/bob/logs/bnf.x5
_sourcetype = cadcamlog
L----------- = 0.096899
L-t<_EQ> = 0.016473

• Was this topic useful?
• Post a comment