Creating a source type helps Splunk to understand the event format. The source type is one of the default fields that Splunk assigns to all the incoming data. Configuring the source type informs Splunk about the type of data ABS provides. This helps Splunk in formatting data intelligently during indexing.

To create a source type, complete the following steps:

  1. Configure a new source type by navigating to Splunk Enterprise > Settings > Source Types > New Source Type.
    The Source Type Events page is displayed.
  2. Configure the New Source Type.

    The fields are defined in the following table.

    Name Value

    Source Type Name

    pi_events_source_type

    Destination app

    Search and Reporting (Can change for your apps)

    Category

    Structures

    Indexed Extractions

    json

    SEDCMD-alter

    s/pi-attack-info-//

    A screenshot of the Edit Source Type page in PingIntelligence.
  3. Create a new index pi_events by navigating to Enterprise > Settings > Indexes > New Index.

    A screenshot of the New Index page in PingIntelligence.