https://community.splunk.com/t5/Splunk-Dev/Change-the-syslog-sourcetype/m-p/56430#M738 <P>Yep it worked.. Thanks for that...</P> Tue, 24 Jan 2012 06:05:52 GMT KarunK 2012-01-24T06:05:52Z https://community.splunk.com/t5/Splunk-Dev/Change-the-syslog-sourcetype/m-p/56428#M736 <P>Hi,</P> <P>I need to change the source-type "syslog" to "abc_syslog". My understanding is we cannot change the source-type once the log is indexing.</P> <P>Any suggestions please ?</P> <P>input.conf file at the forwader is given below. I tried to add the sourcetype at the forwarder as "abc_syslog" in the input.conf file (below), but the splunk even stopped indexing.</P> <PRE><CODE>[monitor:///var/adm/messages] host = ssapp0813 index = abc_syslog </CODE></PRE> Tue, 24 Jan 2012 01:41:05 GMT https://community.splunk.com/t5/Splunk-Dev/Change-the-syslog-sourcetype/m-p/56428#M736 KarunK 2012-01-24T01:41:05Z https://community.splunk.com/t5/Splunk-Dev/Change-the-syslog-sourcetype/m-p/56429#M737 <P>Judging by the example given, you changed the index, not the sourcetype.</P> <P>If you're wanting to change all the sourcetypes from the source /var/adm/messages, you can do the following:</P> <P>On the indexer, add the following to $SPLUNK_HOME/etc/system/local/props.conf</P> <P>[source::/var/adm/messages]</P> <P>sourcetype=abc_syslog</P> <P>Brian</P> Tue, 24 Jan 2012 03:02:45 GMT https://community.splunk.com/t5/Splunk-Dev/Change-the-syslog-sourcetype/m-p/56429#M737 Brian_Osburn 2012-01-24T03:02:45Z https://community.splunk.com/t5/Splunk-Dev/Change-the-syslog-sourcetype/m-p/56430#M738 <P>Yep it worked.. Thanks for that...</P> Tue, 24 Jan 2012 06:05:52 GMT https://community.splunk.com/t5/Splunk-Dev/Change-the-syslog-sourcetype/m-p/56430#M738 KarunK 2012-01-24T06:05:52Z