https://community.splunk.com/t5/Getting-Data-In/Should-an-app-s-source-type-prefixes-be-all-lower-case-or/m-p/13065#M1127 <P>For anything we have defined (other than windows logs) it has been lower case i.e. "sep:ids". Windows we went with PascalCase to conform with the default Splunk sourcetype of "WinEventLog". So for windows logs we have eventtypes of "Snare:Security" and "Monitorware:Security"</P> Fri, 07 May 2010 08:56:22 GMT hazekamp 2010-05-07T08:56:22Z https://community.splunk.com/t5/Getting-Data-In/Should-an-app-s-source-type-prefixes-be-all-lower-case-or/m-p/13064#M1126 <P>We're building an app for WebSphere. We're prefixing all the app's sourcetypes with "WebSphere:" to disambiguate them from other apps' sourcetypes. </P> <P>Now we need to decide about lowercase or PascalCase for our sourcetype prefix.</P> <P>Is it preferable to do "websphere:somesourcetype" or "WebSphere:somesourcetype"?</P> Fri, 07 May 2010 07:40:26 GMT https://community.splunk.com/t5/Getting-Data-In/Should-an-app-s-source-type-prefixes-be-all-lower-case-or/m-p/13064#M1126 Justin_Grant 2010-05-07T07:40:26Z https://community.splunk.com/t5/Getting-Data-In/Should-an-app-s-source-type-prefixes-be-all-lower-case-or/m-p/13065#M1127 <P>For anything we have defined (other than windows logs) it has been lower case i.e. "sep:ids". Windows we went with PascalCase to conform with the default Splunk sourcetype of "WinEventLog". So for windows logs we have eventtypes of "Snare:Security" and "Monitorware:Security"</P> Fri, 07 May 2010 08:56:22 GMT https://community.splunk.com/t5/Getting-Data-In/Should-an-app-s-source-type-prefixes-be-all-lower-case-or/m-p/13065#M1127 hazekamp 2010-05-07T08:56:22Z