sourcetypes.conf
The following are the spec and example files for sourcetypes.conf
.
sourcetypes.conf.spec
# Version 7.3.9 # # NOTE: sourcetypes.conf is a machine-generated file that stores the document # models used by the file classifier for creating source types. # Generally, you should not edit sourcetypes.conf, as most attributes are # machine generated. However, there are two attributes which you can change. # # There is a sourcetypes.conf in $SPLUNK_HOME/etc/system/default/ To set custom # configurations, place a sourcetypes..conf in $SPLUNK_HOME/etc/system/local/. # For examples, see sourcetypes.conf.example. You must restart Splunk to enable # configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles
GLOBAL SETTINGS
# Use the [default] stanza to define any global settings. # * You can also define global settings outside of any stanza, at the top of # the file. # * Each conf file should have at most one default stanza. If there are # multiple default stanzas, attributes are combined. In the case of # multiple definitions of the same attribute, the last definition in the # file wins. # * If an attribute is defined at both the global level and in a specific # stanza, the value in the specific stanza takes precedence. _sourcetype = <value> * Specifies the sourcetype for the model. * Change this to change the model's sourcetype. * Future sources that match the model will receive a sourcetype of this new name. _source = <value> * Specifies the source (filename) for the model.
sourcetypes.conf.example
# Version 7.3.9 # # This file contains an example sourcetypes.conf. Use this file to configure # sourcetype models. # # NOTE: sourcetypes.conf is a machine-generated file that stores the document # models used by the file classifier for creating source types. # # Generally, you should not edit sourcetypes.conf, as most attributes are # machine generated. However, there are two attributes which you can change. # # To use one or more of these configurations, copy the configuration block into # sourcetypes.conf in $SPLUNK_HOME/etc/system/local/. You must restart Splunk # to enable configurations. # # To learn more about configuration files (including precedence) please see the # documentation located at # http://docs.splunk.com/Documentation/Splunk/latest/Admin/Aboutconfigurationfiles # # This is an example of a machine-generated sourcetype models for a fictitious # sourcetype cadcamlog. # [/Users/bob/logs/bnf.x5_Thu_Dec_13_15:59:06_2007_171714722] _source = /Users/bob/logs/bnf.x5 _sourcetype = cadcamlog L----------- = 0.096899 L-t<_EQ> = 0.016473
source-classifier.conf | splunk-launch.conf |
This documentation applies to the following versions of Splunk® Enterprise: 7.3.9
Feedback submitted, thanks!