Conditional processing based on inferred sourcetypes

A computer-implemented system, comprising:

• one or more processors;
• and
• computer memory having instructions stored thereon, the instructions, when executed by the one or more processors, to cause the system to perform a method, comprising:
• accessing messages of a first data stream from an ingestion buffer in communication with a streaming data processor to receive data from the first data stream;
• determining, by the streaming data processor, a sourcetype associated with one or more messages from the first data stream based at least on the streaming data processor applying the one or more messages from the first data stream to an inference model, the one or more messages including a portion of machine data generated by one or more components in an information technology environment;
• generating, by the streaming data processor, a second data stream from the first data stream, the second data stream comprising a subset of the messages from the first data stream, a message of the subset of the messages being included in the second data stream based on a condition associated with the sourcetype for the message and the determining of the sourcetype;
• publishing the second data stream to a topic of the ingestion buffer;
• and
• performing at least one processing operation on at least one of the subset of the messages from the second data stream.

One or more non-transitory computer-readable media having instructions stored thereon, the instructions, when executed by at least one processor of at least one computing device, to cause the at least one computing device to perform a method, comprising:

• accessing messages of a first data stream from an ingestion buffer in communication with a streaming data processor to receive data from the first data stream;
• determining, by the streaming data processor, a sourcetype associated with one or more messages from the first data stream based at least on the streaming data processor applying the one or more messages from the first data stream to an inference model, the one or more messages including a portion of machine data generated by one or more components in an information technology environment;
• generating, by the streaming data processor, a second data stream from the first data stream, the second data stream comprising a subset of the messages from the first data stream, a message of the subset of the messages being included in the second data stream based on a condition associated with the sourcetype for the message and the determining of the sourcetype;
• publishing the second data stream to a topic of the ingestion buffer;
• and
• performing at least one processing operation on at least one of the subset of the messages from the second data stream.