On April 3, 2023, Splunk Data Stream Processor will reach its end of sale, and will reach its end of life on February 28, 2025. If you are an existing DSP customer, please reach out to your account team for more information.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor.
For documentation on the most recent version, go to the latest release.
Download topic as PDF
Add a sourcetype
You can set a sourcetype using an eval function.
If you do not add a sourcetype to your data and you send your data to Splunk Enterprise, your data is automatically indexed with the default httpevent sourcetype.
Set a sourcetype manually
Set a sourcetype on your data with the Eval streaming function. The Eval function adds or updates an existing field to your record.
- From the Data Pipelines editor, click on the + icon and add the Eval function to your pipeline.
- In the Eval function, type the following. This sets your source_type field to
buttercup_sales.
source_type="buttercup_sales"
- With your Eval function highlighted, click Start Preview and send some data in to verify that the expression is working as expected.
Last modified on 28 September, 2020
|
PREVIOUS Aggregate records in a pipeline |
NEXT Adding, removing, and updating fields |
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.1.0
Feedback submitted, thanks!