Splunk Cloud

Getting Data In

Acrobat logo Download manual as PDF

This documentation does not apply to the most recent version of SplunkCloud. Click here for the latest version.
Acrobat logo Download topic as PDF

Modify input settings

After you select the source (or set your source type when uploading or monitoring a single file), the Modify input settings page appears:

You can specify additional parameters for your data input, such as its source type, its application context, its host value, and the index where data from the input should be stored.

Configure source type

You can specify the source type to be applied to your data with the Source type setting. This setting appears when:

  • You specify a directory as a data source.
  • You specify a network input as a data source.
  • You specify a data source that has been forwarded from another Splunk instance.

If your data source does not meet these criteria, then the Source type setting does not appear.

Specify a source type

  1. Click one of the buttons.
    • Select: Applies the source type you specify to the data. When you click "Select", a drop-down appears.
    • New: Adds a new source type. When you click "New", two text fields and a drop-down appear.

Choose an existing source type

  1. From the Select Source Type drop-down, choose the category that best represents the source type you want.
  2. Choose the source type from the pop-up list that appears.

Add a new source type

  1. In the Source Type text field, enter the name of the new source type.
  2. Choose a category for the source type in the Source Type Category drop down.
  3. In the Source Type Description field, enter the description for the source type.

Configure app context

The Application Context setting determines the context in which the input should collect data. Application contexts improve manageability of input and source type definitions. App contexts are loaded based on precedence rules. See Configuration file precedence in the Splunk Enterprise Admin Manual.

  • Select the application context you want this input to operate within by clicking the drop-down list and selecting the application context you want.

Configure host value

The forwarder tags events with a host. You can configure how the software determines the host value.

  • IP: Uses the IP address of the host from which the event originates.
  • DNS: Use Domain Name Services (DNS). Events are tagged with the host name that Splunk software determines using DNS name resolution.
  • Custom: Uses the host value you assign in the "Host field value" text box that appears when you select this option.


The Index setting determines the index where the events for this input should be stored.

  1. To use the default index, leave the drop-down list set to Default. Otherwise, click the drop-down list and select the index you want the data to go to by clicking the selection in the list.
  2. (Optional) If the index you want to send the data to is not in the list, and you have permissions to create indexes, you can create a new index by clicking the Create a new index button.

After you make your selections, click Next to proceed to the final step of the Add Data process.

Last modified on 15 February, 2020
Modify event processing
Monitor files and directories on a forwarder

This documentation applies to the following versions of Splunk Cloud: 7.2.4, 7.2.6, 7.2.7, 7.2.8, 7.2.9

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters