Add source types manually

  • Release version: Washingtondc
  • Updated February 1, 2024
  • 1 minute to read

    • Create a source type manually before you configure a data input if you want to stream log data to a specific source type rather than to the source type automatically extracted by Health Log Analytics during the mapping process.

    Before you begin

    This feature is supported in the Health Log Analytics application, Version 20.0.11 - July 2021, available from the ServiceNow Store.

    Role required: evt_mgmt_admin

    Procedure

    1. Navigate to All > Health Log Analytics > Data Input > Source Types.
    2. On the Source Types page, select New.
    3. On the form, fill in the fields.
      Table 1. Source type form
      Field Description
      Name The name of the source type.

      The name must be between 3-50 characters long. Acceptable characters are letters, numeric values, dashes, and underscores.
      Examples One or more raw input samples for this source type. Enter each sample on a new line.
      Note:
      This field must contain data.

      The fields in the following table are read-only.

      Field Description
      Created manually Option for indicating that this source type was created manually. Default: true.
      Auto-extraction enabled Auto-extraction for this source type is disabled by default.
      Learning mode Option for indicating that Learning mode for the source type is ongoing.

      The AI engine must learn the format of log messages in each new log stream. In Learning mode, it learns the format of messages for this source type and extracts properties based on that knowledge.
    4. Right-click the form header and select Save.
    5. Select Load examples to load the raw input samples for this source type that you provided in the Examples field.
      When loading the log samples is completed successfully, the Examples field and the Load examples buttons no longer appear on the form.
    6. Optional: Check how the AI engine has parsed the raw input samples by selecting the Go to Source Type Structure related link and modify the extracted properties if necessary.
    7. Click Submit.

    What to do next

    Configure a data input and then map it to the new source type. For more information, see Set up data inputs manually and Map raw log data.