Edit, clone, or delete source types for Edge Processors
As an administrator, you can use the Source types page to manage the source type definitions that are available in your tenant. You can use this page to edit, clone, and delete existing source types.
Edit a source type
You can modify the event breaking and merging configuration of a source type by completing the following steps.
- Navigate to the Source types page.
- In the row listing the source type that you want to modify, select the Actions icon () and select Edit.
- Modify the source type as needed. For information about all the available configuration settings, see Add source types for Edge Processors.
- (Optional) To confirm that your updated source type configuration works as expected, generate a preview that shows how the source type configuration breaks and merges inbound data streams into events. Do the following:
- Select the Edit Sample Data icon ().
- In the Edit sample data dialog box, enter or upload sample data for generating the preview.
The sample data must be in the same format as the actual data that is associated with the source type. See Getting sample data for previewing data transformations for more information.
- Select Save.
- Select the Run To Preview Source Type icon () to generate the preview. Use the preview results to validate your source type configuration.
- Select Save source type. Then, select Save to continue and save your changes.
The Edge Processor service returns a message confirming that your changes are saved successfully.
If this source type is used by any pipelines that are already applied to Edge Processors, then you need to refresh your pipelines to make sure that they use the updated source type configuration. See Refresh a pipeline for more information.
Clone a source type
You can use the Clone action to create a backup copy of a source type. You can also clone an existing source type and use it as a starting point for a new source type configuration.
- Navigate to the Source types page.
- In the row listing the source type that you want to modify, select the Actions icon () and select Clone.
The Edge Processor service creates a copy of the source type, and adds the suffix _clone
to the source type name.
Delete a source type
You can delete a source type from the system by completing the following steps.
- Navigate to the Source types page.
- In the row listing the source type that you want to modify, select the Actions icon () and select Delete.
- When prompted to confirm your choice, select Delete.
The Edge Processor service returns a message confirming that your source type was deleted successfully.
Add source types for Edge Processors | Get data from a forwarder into an Edge Processor |
This documentation applies to the following versions of Splunk Cloud Platform™: 9.0.2209, 9.0.2303, 9.0.2305, 9.1.2308, 9.1.2312, 9.2.2403, 9.2.2406 (latest FedRAMP release)
Feedback submitted, thanks!