Splunk Cloud Platform

Use Edge Processors

Edit, clone, or delete source types for Edge Processors

As an administrator, you can use the Source types page to manage the source type definitions that are available in your tenant. You can use this page to edit, clone, and delete existing source types.

Edit a source type

You can modify the event breaking and merging configuration of a source type by completing the following steps.

  1. Navigate to the Source types page.
  2. In the row listing the source type that you want to modify, select the Actions icon (Image of the Actions icon) and select Edit.
  3. Modify the source type as needed. For information about all the available configuration settings, see Add source types for Edge Processors.
  4. (Optional) To confirm that your updated source type configuration works as expected, generate a preview that shows how the source type configuration breaks and merges inbound data streams into events. Do the following:
    1. Select the Edit Sample Data icon (Image of the Edit sample data icon).
    2. In the Edit sample data dialog box, enter or upload sample data for generating the preview.

      The sample data must be in the same format as the actual data that is associated with the source type. See Getting sample data for previewing data transformations for more information.

    3. Select Save.
    4. Select the Run To Preview Source Type icon (This image shows an icon with a triangle pointing right.) to generate the preview. Use the preview results to validate your source type configuration.
  5. Select Save source type. Then, select Save to continue and save your changes.

The Edge Processor service returns a message confirming that your changes are saved successfully.

If this source type is used by any pipelines that are already applied to Edge Processors, then you need to refresh your pipelines to make sure that they use the updated source type configuration. See Refresh a pipeline for more information.

Clone a source type

You can use the Clone action to create a backup copy of a source type. You can also clone an existing source type and use it as a starting point for a new source type configuration.

  1. Navigate to the Source types page.
  2. In the row listing the source type that you want to modify, select the Actions icon (Image of the Actions icon) and select Clone.

The Edge Processor service creates a copy of the source type, and adds the suffix _clone to the source type name.

Delete a source type

You can delete a source type from the system by completing the following steps.

  1. Navigate to the Source types page.
  2. In the row listing the source type that you want to modify, select the Actions icon (Image of the Actions icon) and select Delete.
  3. When prompted to confirm your choice, select Delete.

The Edge Processor service returns a message confirming that your source type was deleted successfully.

Last modified on 24 June, 2023
Add source types for Edge Processors   Get data from a forwarder into an Edge Processor

This documentation applies to the following versions of Splunk Cloud Platform: 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release)


Was this topic useful?







You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters