Refine your search:

How can you add additional sourcetypes to the pre-defined sourcetypes, so that way when users add inputs through the GUI, the custom sourcetypes are on the dropdown menu?

asked 06 Oct '10, 13:59

BunnyHop's gravatar image

BunnyHop
7254424
accept rate: 25%


One Answer:

The following in props.conf will do it:

[yoursourcetype]
pulldown_type = true

Setting this may or may not be a bad idea, since it falls under the heading of "# NOT YOURS. DO NOT SET" in the docs: http://www.splunk.com/base/Documentation/4.1.5/admin/Propsconf

link

answered 06 Oct '10, 14:29

southeringtonp's gravatar image

southeringtonp ♦
4.5k1215
accept rate: 35%

not sure if it's required but I had to restart my Splunk instance, but this worked!

(19 Oct '10, 15:01) BunnyHop

Guessing here, but it probably enough to restart of SplunkWeb. Restarting splunkd seems unnecessary.

(26 Oct '11, 21:14) southeringtonp ♦
Post your answer
toggle preview

Follow this question

Log In to enable email subscriptions

RSS:

Answers

Answers + Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "Title")
  • image?![alt text](/path/img.jpg "Title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Tags:

×154

Asked: 06 Oct '10, 13:59

Seen: 731 times

Last updated: 26 Oct '11, 21:14

Copyright © 2005-2012 Splunk, Inc. All rights reserved.