Add a sourcetype in DSP
You can set a sourcetype using an eval function in the Data Stream Processor (DSP).
If you don't add a sourcetype to your data and you send your data to Splunk Enterprise, your data is automatically indexed with the default httpevent
sourcetype.
Set a sourcetype manually
Set a sourcetype on your data with the eval streaming function. The eval function adds or updates an existing field to your record.
- From the Data Pipelines editor, click the + icon and add the Eval function to your pipeline.
- In the Eval function, type the following. This sets your
source_type
field tobuttercup_sales
.
as("buttercup_sales","source_type");
- With your eval function highlighted, click Start Preview and send some data in to verify that the expression is working as expected.
Masking sensitive data in DSP | Filtering data in DSP |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.0.0
Feedback submitted, thanks!