Help us improve your experience.

Let us know what you think.

Do you have time for a two-minute survey?

 

Configuring a Log Source Type

 

With the DSM Editor, you can configure a new log source type or use an existing one in JSA.

You can configure log sources for custom applications and systems that have no supported DSM. Rather than using a universal DSM (uDSM), you can create a new log source type by using the DSM Editor. Then you can associate the incoming events and extra content (custom properties, searches, rules, and so on) with just that log source type. When a uDSM is used for all event feed, that have no supported DSM, any associated content is run against all of these events. Running the uDSM in this scenario is not good for system performance.

Note
  • The DSM Editor works on only one log source type at a time.

  • You can delete custom log source types. Deleted log source types are not presented as an option when you create a new log source, and are not available for editing in the DSM Editor, but any existing log sources of this type remain active.

  1. On the navigation menu (), click Admin to open the admin tab.
  2. In the Data Sources section, click DSM Editor.
  3. Create a log source type or select an existing log source type:
    • To create a new log source type, click Create New and follow the prompts.

    • To locate an existing log source type, use the filter field and then click Select.