
input
Description
Adds or disables sources from being processed by the search. Enables or disables inputs in inputs.conf with optional sourcetype and index settings. Any additional attribute=values
are added to inputs.conf. If you have Splunk Enterprise, you can view the log of changes to inputs in the following file: $SPLUNK_HOME/var/log/splunk/inputs.log.
Syntax
input (add | remove) [sourcetype=string] [index=string] [string=string]...
Optional arguments
- sourcetype
- Datatype: <string>
- Description: When adding a new input, label the input so the data it acquires uses this sourcetype.
- index
- Datatype: <string>
- Description: When adding a new input, label the input so the data it acquires is sent to this index. Make sure this index exists.
- string
- Datatype: <string>
- Description: Used to specify custom user fields.
Examples
Example 1:
Remove all csv files that are currently being processed.
search source=*csv | input remove
Answers
Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the input command.
PREVIOUS iconify |
NEXT inputcsv |
This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.1, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.3, 7.0.4, 7.0.5, 7.0.6, 7.0.7, 7.0.8, 7.0.9, 7.0.10, 7.0.11, 7.0.13
Feedback submitted, thanks!