Splunk 7.x Quick Start Guide

Creating custom source types

If you need to create a custom sourcetype for your unusual log type or other data source, you can clone an existing sourcetype and modify it for your purposes if the log you're wanting to ingest is similar to an existing known format. Otherwise, you will need to create a props.conf file that gets stored in your $SPLUNK_HOME/etc/apps/<app folder>/local directory, which contains the needed entries to properly parse the incoming data.

You can peruse the examples in the .../default/props.conf file, as well as all the options for props.conf and transforms.conf files in the following Splunk docs:

• http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter
• https://docs.splunk.com/Documentation/Splunk/latest/Admin/Propsconf ...