SPLUNK INPUTS.CONF ADD APPLICATION TAG INSTALL
SPLUNK INPUTS.CONF ADD APPLICATION TAG SOFTWARE

Note:' A Splunk Enterprise instance might have multiple versions of some configuration files, in several directories. The only exception is the 'System' app: If you choose that app when saving the source type, the file resides in $SPLUNK_HOME/etc/system/local. If you later create additional source types, they are saved to the same nf file.įor example, if you selected the 'Search and Reporting' app, the file resides in $SPLUNK_HOME/etc/apps/search/local/nf.

SPLUNK INPUTS.CONF ADD APPLICATION TAG SOFTWARE

When you create a source type in the 'Set Sourcetype' page, the software saves the source type definition as a stanza in a nf file in the app that you selected when you saved the source type. When a forwarder sends data that has been tagged with the new source type to an indexer, the indexer can correctly process it into events. Use the new source type when you define an input on forwarders that send data to those indexers.Distribute the nf file that contains the source type definition to the $SPLUNK_HOME/etc/system/local directory on indexers that you want to index data with the source type you created.

SPLUNK INPUTS.CONF ADD APPLICATION TAG INSTALL

To install this new source type, follow these high-level steps: You can use a new source type in a distributed environment where you have forwarders consuming data and then sending the data to indexers. You can then distribute this file to other Splunk Enterprise instances so that they recognize the new source type. Either of these pages saves a new source type to a nf configuration file on the local Splunk Enterprise instance. You can use either the ' Set source type' or source type management pages in Splunk Web to create new source types, which you can then assign to inputs from specific files or directories, or for network inputs. However, if you have Splunk Enterprise and manage a distributed configuration, you must distribute new source type as described in this topic. If you create source types in Splunk Cloud Platform using Splunk Web, Splunk Cloud Platform manages the source type configurations automatically. Distribute source type configurations in Splunk Enterprise

Splunk inputs.conf add application tag