input

Description

Adds or disables sources from being processed by the search. Enables or disables inputs in inputs.conf with optional sourcetype and index settings. Any additional attribute=values are added to inputs.conf. If you have Splunk Enterprise, you can view the log of changes to inputs in the following file: $SPLUNK_HOME/var/log/splunk/inputs.log.

Syntax

input (add | remove) [sourcetype=string] [index=string] [string=string]...

Optional arguments

sourcetype

Datatype: <string>

Description: When adding a new input, label the input so the data it acquires uses this sourcetype.

index

Datatype: <string>

Description: When adding a new input, label the input so the data it acquires is sent to this index. Make sure this index exists.

string

Datatype: <string>

Description: Used to specify custom user fields.

Examples

Example 1:

Remove all csv files that are currently being processed.

search source=*csv | input remove

Answers

Have questions? Visit Splunk Answers and see what questions and answers the Splunk community has using the input command.