Add a sourcetype
You can set a sourcetype using an eval function.
If you do not add a sourcetype to your data and you send your data to Splunk Enterprise, your data is automatically indexed with the default httpevent
sourcetype.
Set a sourcetype manually
Set a sourcetype on your data with the Eval
streaming function. The Eval function adds or updates an existing field to your record.
- From the Data Pipelines editor, click on the + icon and add the Eval function to your pipeline.
- In the Eval function, type the following. This sets your source_type field to
buttercup_sales
.
source_type="buttercup_sales"
- With your Eval function highlighted, click Start Preview and send some data in to verify that the expression is working as expected.
Aggregate records in a pipeline | Adding, removing, and updating fields |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0
Feedback submitted, thanks!