https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Override/m-p/64296#M12939 <P>if your events can be identified via regex, you can do this: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides</A></P> <P>you'll need to do this on the indexer--this won't work on the forwarder, unless it's a 'heavy forwarder'. </P> Fri, 03 Feb 2012 19:03:53 GMT piebob 2012-02-03T19:03:53Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Override/m-p/64295#M12938 <P>Hi guys... I have a couple of script inputs that generate network status data... the issue is that a single script inputs data for multiple sourcetypes... The data itself has a filed sourcetype=$value$</P> <P>is there a simple way to override the default sourcetype "exec" like for host override:</P> <P>[sourcetype-override]<BR /> REGEX = (?i)sourcetype=(\w+)<BR /> FORMAT = sourcetype::$1<BR /> DEST_KEY = MetaData:SourceType</P> Fri, 03 Feb 2012 14:42:27 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Override/m-p/64295#M12938 kenchisho 2012-02-03T14:42:27Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Override/m-p/64296#M12939 <P>if your events can be identified via regex, you can do this: </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides</A></P> <P>you'll need to do this on the indexer--this won't work on the forwarder, unless it's a 'heavy forwarder'. </P> Fri, 03 Feb 2012 19:03:53 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Override/m-p/64296#M12939 piebob 2012-02-03T19:03:53Z https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Override/m-p/64297#M12940 <P>thnx. i'we seen the guide but this will not work in this case... the examples in the guide match a regex and then based on that match set the source type manually...</P> <P>[some_stanza]<BR /> REGEX = some_regex<BR /> FORMAT = sourcetype::my_log (manually set source type to my_log)<BR /> DEST_KEY = MetaData:Sourcetype</P> <P>This would require a stanza in props.conf for every source type i wish to have for a single scripted input source...</P> <P>what i am trying is to extract the source type itself using a regex and route those events to that source type...</P> Mon, 28 Sep 2020 10:23:29 GMT https://community.splunk.com/t5/Getting-Data-In/Sourcetype-Override/m-p/64297#M12940 kenchisho 2020-09-28T10:23:29Z