splunk source types
Splunk Enterprise classifies source data by source etype, such as syslog, access_combined, or apache_error, and extracts timestamps, dividing the data into individual events, which can be a single- or multiple-line events.