Splunk 7.x Quick Start Guide

Splunk sourcetypes

Splunk uses specific configuration files for telling the indexers how to parse incoming data to properly extract the timestamps and specific event fields, and how to identify when one event ends and the next one starts (linebreaks); this is done with a props.conf file. In some cases, you'll need to tell Splunk how to transform (modify or add) data from existing fields into new fields and/or modify or mask those fields–this is done with a transforms.conf file. The props.conf file contains stanzas that define a sourcetype and how it behaves; entries in the props.conf stanzas can also reference stanzas in a transforms.conf file to perform transformation operations.

A sourcetype is one of the default metadata fields that ...