DSP 1.2.0 is impacted by the CVE-2021-44228 and CVE-2021-45046 security vulnerabilities from Apache Log4j. To fix these vulnerabilities, you must upgrade to DSP 1.2.4. See Upgrade the Splunk Data Stream Processor to 1.2.4 for upgrade instructions.
On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details.
On October 30, 2022, all 1.2.x versions of the Splunk Data Stream Processor will reach its end of support date. See the Splunk Software Support Policy for details.
This documentation does not apply to the most recent version of Splunk® Data Stream Processor.
For documentation on the most recent version, go to the latest release.
Add a sourcetype
You can set a sourcetype using an eval function.
If you do not add a sourcetype to your data and you send your data to Splunk Enterprise, your data is automatically indexed with the default httpevent sourcetype.
Set a sourcetype manually
Set a sourcetype on your data with the Eval streaming function. The Eval function adds or updates an existing field to your record.
- From the Data Pipelines editor, click on the + icon and add the Eval function to your pipeline.
- In the Eval function, type the following. This sets your source_type field to
buttercup_sales.
source_type="buttercup_sales"
- With your Eval function highlighted, click Start Preview and send some data in to verify that the expression is working as expected.
Last modified on 28 September, 2020
This documentation applies to the following versions of Splunk® Data Stream Processor: 1.2.0
Download manual
Feedback submitted, thanks!