hi
i would like add some sourcetype.
Adding thoungh Web Browser is easy,
just click create sourcetype button and not need splunk restart
I found a cli command to add a sourcetype, but I couldn't find it.
One way i found
The sourcetype is written directly to the props.conf file.
but it's need splunk restart
I'm writing an auto define script for some log files
so i can't use restart splunk
i want not need splunk restart & cli command like a web browser
thk~
↧