To complete the configuration of Splunk for PingIntelligence, you need to create a source type. Creating a source type helps Splunk to understand the event format.
The source type is one of the default fields that Splunk assigns to all the incoming data. Configuring the source type informs Splunk about the type of data ABS provides. This helps Splunk in formatting data intelligently during indexing.
To create a source type:
- Configure a new source type by navigating to . The source type events page is displayed.
Configure the New Source type. The fields are defined in the following
Name Value Source type name
Destination app Search and Reporting (Can change for your apps) Category Structures Indexed extractions
Create a new index
pi_eventsby navigating to .