https://community.splunk.com/t5/Getting-Data-In/Q-Sourcetype-renaming/m-p/92909#M19330 <P>No, you should not use quotes in the stanzas. Other than that, your renaming looks OK.</P> Wed, 17 Oct 2012 07:29:13 GMT Ayn 2012-10-17T07:29:13Z https://community.splunk.com/t5/Getting-Data-In/Q-Sourcetype-renaming/m-p/92908#M19329 <P>I want to rename an 'old' sourcetype (access:mwp) into a new one (access:web:mwp). Does this work in my props.conf:</P> <P>["access:mwp"]<BR /> rename=access:web:mwp</P> <P>["access:web:mwp"]<BR /> NO_BINARY_CHECK=1<BR /> SHOULD_LINEMERGE=false<BR /> TIME_PREFIX=^<BR /> MAX_TIMESTAMP_LOOKAHEAD=50<BR /> TIME_FORMAT=%b %d, %Y %H:%M:%S %P</P> Mon, 28 Sep 2020 12:38:18 GMT https://community.splunk.com/t5/Getting-Data-In/Q-Sourcetype-renaming/m-p/92908#M19329 mkelderm 2020-09-28T12:38:18Z https://community.splunk.com/t5/Getting-Data-In/Q-Sourcetype-renaming/m-p/92909#M19330 <P>No, you should not use quotes in the stanzas. Other than that, your renaming looks OK.</P> Wed, 17 Oct 2012 07:29:13 GMT https://community.splunk.com/t5/Getting-Data-In/Q-Sourcetype-renaming/m-p/92909#M19330 Ayn 2012-10-17T07:29:13Z