topic How to send specific logs to a sourcetype? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-send-specific-logs-to-a-sourcetype/m-p/623412#M107271 <P>Hello All,</P> <P>&nbsp;</P> <P>I have query&nbsp;index=xxxx sourcetype=xxx_* NOT(ASA) which actually filters logs that are not ASA from 4 sourcetypes , i want to send these resulted logs to a new sourcetype call xxx_analmoly&nbsp;</P> <P>&nbsp;</P> <P>Is it possible if yes , how can i achieve this&nbsp;</P> Tue, 06 Dec 2022 14:46:56 GMT deepthi5 2022-12-06T14:46:56Z How to send specific logs to a sourcetype? https://community.splunk.com/t5/Getting-Data-In/How-to-send-specific-logs-to-a-sourcetype/m-p/623412#M107271 <P>Hello All,</P> <P>&nbsp;</P> <P>I have query&nbsp;index=xxxx sourcetype=xxx_* NOT(ASA) which actually filters logs that are not ASA from 4 sourcetypes , i want to send these resulted logs to a new sourcetype call xxx_analmoly&nbsp;</P> <P>&nbsp;</P> <P>Is it possible if yes , how can i achieve this&nbsp;</P> Tue, 06 Dec 2022 14:46:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-specific-logs-to-a-sourcetype/m-p/623412#M107271 deepthi5 2022-12-06T14:46:56Z Re: send specific logs to a sourcetype https://community.splunk.com/t5/Getting-Data-In/How-to-send-specific-logs-to-a-sourcetype/m-p/623418#M107272 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/55813">@deepthi5</a>,</P><P>no, I'm sorry: when an event is indexed isn't possible to change the sourcetype.</P><P>You have to define the new sourcetype rules (regexes) and override the original value before indexing, following the steps described at&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Advancedsourcetypeoverrides#:~:text=You%20can%20override%20source%20types,directly%20on%20the%20instance%20itself" target="_blank">https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Advancedsourcetypeoverrides#:~:text=You%20can%20override%20source%20types,directly%20on%20the%20instance%20itself</A>.</P><P>Ciao.</P><P>Giuseppe</P> Tue, 06 Dec 2022 13:01:27 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-send-specific-logs-to-a-sourcetype/m-p/623418#M107272 gcusello 2022-12-06T13:01:27Z