Modify event processing

You can change the event processing settings and save the improved settings as a new source type.

1. View the event data, as described in Assign the correct source types to your data.
2. Modify the event processing settings.
3. Review the effect of your changes until you are satisfied.
4. Save the modified settings as a new source type.
5. Apply the new source type to any of your inputs.

Modify the event processing settings

To create the new source type, use the event-breaking and timestamp settings, then save the source type.

On the Set Source Type page, you can make three types of adjustments using the following collapsible tabs:

• Event Breaks. Adjust the way that breaks the data into events.
• Timestamps. Adjust the way determines event timestamps.
• Advanced tab. If you have Splunk Enterprise, edit props.conf.

Modify event breaks

To modify event break parameters, click Event Breaks. You can choose the following break types:

• Auto. Break events based on the location of timestamps in the data.
• Every line. Consider every line a single event.
• Regex... Use the specified regular expression to break data into events.

For information on line breaking, see Configure event line breaking. You can test your regular expression by using it in a search with the rex search command.

Modify timestamps

To modify timestamp recognition parameters, click the Timestamps tab to expand it.

You can choose from these extraction options:

• Auto. Locate the timestamp automatically.
• Current Time. Uses the current system time.
• Advanced. Specify additional advanced parameters to adjust the timestamp.

Then, you can configure additional advanced parameters:

• Timezone. The time zone that you want to use for the events.
• Timestamp format. A string that represents the timestamp format for to use when searching for timestamps in the data. See Configure timestamp recognition.
• Timestamp prefix. A regular expression that represents the characters that appear before a timestamp.
• Lookahead. The number of characters that looks either into the event, or for the regular expression that you specified in "Timestamp prefix" for the timestamp.

If you specify a timestamp format in the Timestamp format field and the timestamp is not located at the very start of each event, you must also specify a prefix in the Timestamp prefix field. Otherwise, the Splunk platform can't process the formatting instructions, and every event will contain a warning about the inability to use strptime. It's possible that you still end up with a valid timestamp, based on how the Splunk platform attempts to recover from the problem.

For information on configuring timestamps, see How timestamp assignment works.

Make advanced modifications

To modify advanced parameters, click the Advanced tab. The tab shows options that let you specify source type properties by editing the underlying props.conf file.

You can add or change source type properties by specifying setting/value pairs. See the props.conf configuration file in the Admin Manual for details on how to set these properties.

The Advanced tab shows the current complete set of properties for the selected source type:

• Settings generated by changes made in the Event Breaks or Timestamps tabs after you click Apply.
• Preexisting settings for a source type that was either auto-detected or manually selected when you first previewed the file.
• Settings you apply from the Additional settings text box after you click Apply settings.

For information on how to set source type properties, see props.conf in the Admin Manual. See also How timestamp assignment works and Configure event line breaking.

How combines settings

The settings changes you make in Advanced tab take precedence. For example, if you alter a timestamp setting using the Timestamps tab and also make a conflicting timestamp change in Advanced tab, the Advanced tab change takes precedence over the modification that you made in the Timestamps tab.

Starting with highest precedence, the following list shows how combines any adjustments with the underlying default settings:

1. Advanced tab changes
2. Event breaks or timestamp changes
3. Settings for the underlying source type, if any
4. Default system settings for all source types

If you make changes in the Advanced tab and then return to the Event Breaks or Timestamps tabs, the changes are not visible from those tabs.

Review your changes

When you are ready to view the effect of your changes, click Apply settings. Splunk Web refreshes the screen, so you can review the effect of your changes on the data.

To make further changes using any of the three adjustment methods available, click Apply changes to view the effect of the changes on your data.

Save modifications as a new source type

1. Click Save As next to the Sourcetype button.
2. In the dialog box that appears, name your new source type, choose the Source type category in which it will appear, and the application context it uses.
   

   Field	Description
   Name	The name of the new source type.
   Description	The description of the new source type.
   Category	The category that the source type appears as when you click Sourcetype.
   App	The app that the new source type uses.

3. Click Save to save the source type and return to the Set Source Type page.

Next step

You have several options after you save the source type:

• (Optional) Click Next to apply the source type to your data and proceed to the Input settings page.
• (Optional) Click the left-pointing angle bracket (<) to go back and choose a new file to upload or monitor.
• (Optional) Click Add data to return to the beginning of the Add Data wizard.