https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70603#M14367 <P>This works for newly collected data, though old data needs to be re-indexed to match the sourcetype.</P> Thu, 18 Oct 2012 13:34:20 GMT stevenpall 2012-10-18T13:34:20Z https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70601#M14365 <P>I have a number of duplicate source types with names like "access-1", "access-2", etc. I would like to combine these into one source type ("access", for example) using the rename function in the props.conf file. </P> <P>I've successfully been able to do this with single source types (changing "access-1" to "access", for example), however when I try to make multiple entries with the same source type as seen below, Splunk creates separate source types called "access".</P> <P>[access-1]<BR /> rename=access</P> <P>[access-2]<BR /> rename=access</P> <P>According to <A href="http://docs.splunk.com/Documentation/Splunk/latest/User/TagAndAliasFieldValues#Rename_source_types">this</A> page, "multiple source types can share the same name", so I believe what I want to do should be possible. Would I need to use regular expressions in a single rename statement to get this working? Is there some other way to do this?</P> <P>Thanks!</P> Tue, 25 Sep 2012 18:41:22 GMT https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70601#M14365 stevenpall 2012-09-25T18:41:22Z https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70602#M14366 <P>Try using a wildcard match on source to rename:</P> <P>[source::...access*.log]<BR /> sourcetype = access</P> Wed, 26 Sep 2012 12:25:19 GMT https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70602#M14366 sblake_splunk 2012-09-26T12:25:19Z https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70603#M14367 <P>This works for newly collected data, though old data needs to be re-indexed to match the sourcetype.</P> Thu, 18 Oct 2012 13:34:20 GMT https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70603#M14367 stevenpall 2012-10-18T13:34:20Z https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70604#M14368 <P>What file is this added to?</P> <P>And how can I re-index things this would affect?</P> Sun, 30 Dec 2012 14:58:10 GMT https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70604#M14368 timhavens 2012-12-30T14:58:10Z https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70605#M14369 <P>props.conf</P> <P>Reindexing is more complex. You would have to remove the old and then reindex it all to set the sourcetype at index time properly. You can set the sourcetype on index time with a setting in inputs.conf for the monitor stanza (the easiest method) or you can get a little more complex with doing event inspection and overriding it before index time: <A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides</A></P> Sun, 30 Dec 2012 15:18:03 GMT https://community.splunk.com/t5/Getting-Data-In/Combine-Multiple-Source-Types-with-Rename-Function/m-p/70605#M14369 sblake_splunk 2012-12-30T15:18:03Z