Prepare Splunk for SP06 – Remove source type
Please note that SAP PowerConnect add-on is compatible only with PowerConnect for Splunk 4.06.
1. Delete definition of sourcetype sap_abap
The definition of sourcetype sap_abap is not needed anymore because PowerConnect for Splunk sends events that Splunk can automatically parse without definition of the sourcetype.
Please note that the sourcetype used is still called sap_abap but the sourcetype does not need any definition in props.conf.
1.1. Find the location of the definition of sourcetype sap_abap
1.1.1. Login to Splunk server
You need to login with user account that allows you to modify props.conf in Splunk folder.
1.1.2. Run command prompt / command shell as administrator
1.1.3. Goto bin directory
1.1.4. Find all props.conf which each attribute definition of sourcetype sap_abap comes from
.\splunk.execmd btool props list sap_abap –debug
1.2. Removethe definition of sourcetype sap_abap
1.2.1. Located the definition
Using the example above, goto the following
1.2.2. Open the file and locate sap_abap
Delete the definition & all attributes
1.2.3. Run command in 3.1.4 again.
Usually the definition exists in the following files
1.2.4. Repeat until the command does not return the definition
1.2.5. Restart Splunk system