Question: what is the difference between source and sourcetype in splunk?
Answer: a system log file, an app log files, lookup files, etc.. ... The source is the name of the file, stream, or other input from which a particular event originates. The sourcetype determines how Splunk software processes the incoming data stream into individual events according to the nature of the data.