topic Re: Sourcetype renaming not taking in Getting Data In

Sourcetype renaming not taking

srich — Wed, 31 Aug 2011 18:56:31 GMT

Following the documentation for sourcetype renaming, I still fail to get it working. I have added an entry in Sourcetype renaming and have created a props.conf file in the etc/system/local directory. I have restarted Splunkd and still zip. I'm running the latest version of Splunk. Help!

props.conf:
[Printer]
rename=System-III

[Printer2]
rename=System-III

[Printer3]
rename=System-III

[Printer-too_small]
rename=System-III

Re: Sourcetype renaming not taking

gnovak — Fri, 18 Nov 2011 17:34:45 GMT

I am also seeing the same thing. I have put a props.conf file in /etc/system/local directory and it looks almost identical in the format of the one post by srich. After about an hour I still am not seeing all my sourcetypes renamed. How long does this take?

Re: Sourcetype renaming not taking

gnovak — Fri, 18 Nov 2011 17:44:00 GMT

Actually one thing i just found out. I put the props.conf on the indexer and it appears to be working. At first I put it on the lightweight forwarder.

Re: Sourcetype renaming not taking

gnovak — Fri, 18 Nov 2011 20:53:45 GMT

After i thought this worked, it actually didn't. I have props.conf on all of my main indexers and still i am not seeing the sourcetype renamed. it's still showing up as the old one.

Re: Sourcetype renaming not taking

ewoo — Tue, 22 Nov 2011 02:15:27 GMT

Sourcetype renaming is a search-time operation. The props.conf with the renamed sourcetype should be placed on your search head. You should be able to observe the renamed sourcetype taking effect immediately by running a search; you do not need to index any new data.

Re: Sourcetype renaming not taking

pgoyal_splunk — Fri, 31 Jan 2020 05:25:40 GMT

If you have Splunk Enterprise, you can use the rename attribute in props.conf to assign events to a new source type at search time. In case you ever need to search on it, the original source type is moved to a separate field, _sourcetype.
Do the changes on the search Head.

You can also refer to the below link to rename the sourcetype at search time.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Renamesourcetypes