Add a sourcetype
You can set a sourcetype using an eval function.
If you do not add a sourcetype to your data and you send your data to Splunk Enterprise, your data is automatically indexed with the default
Set a sourcetype manually
Set a sourcetype on your data with the
Eval streaming function. The Eval function adds or updates an existing field to your record.
- From the Data Pipelines editor, click on the + icon and add the Eval function to your pipeline.
- In the Eval function, type the following. This sets your source_type field to
- With your Eval function highlighted, click Start Preview and send some data in to verify that the expression is working as expected.
Aggregate records in a pipeline
Adding, removing, and updating fields
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0