topic Re: Convert sourcetype in Getting Data In

Convert sourcetype

sloshburch — Fri, 18 Oct 2013 18:45:17 GMT

I've got a file that was previously indexed as sourcetype1 but I want it to be customer_sourcetype2. I thought there was a way in splunk to have splunk, at search time, reassign that search type. Am I wrong?

I thought I could do this with a props.conf entry:

[source::/path/to/file/filename.log]
    sourcetype = customer_sourcetype2

Someone correct my understanding?

Re: Convert sourcetype

kristian_kolb — Fri, 18 Oct 2013 19:11:57 GMT

Perhaps have a look here:

http://docs.splunk.com/Documentation/Splunk/6.0/Data/Renamesourcetypes

This is the closest you are going to get, I'm afraid. sourcetype is one of those things that cannot be truly changed after the data has been indexed.

Re: Convert sourcetype

sdaniels — Fri, 18 Oct 2013 19:14:19 GMT

Just found that as well...

Re: Convert sourcetype

sloshburch — Fri, 18 Oct 2013 19:26:36 GMT

Oh wow thanks! I'm guessing that won't work if I can only specify the source. There are other sources with the same sourcetype1 which I don't want to change sourcetypes for.

[source::/path/to/file/filename.log] rename = customer_sourcetype2

Re: Convert sourcetype

sloshburch — Fri, 18 Oct 2013 19:29:19 GMT

Yea - looks like that's the case.

rename =
* Renames [] as
* With renaming, you can search for the [] with sourcetype=
* To search for the original source type without renaming it, use the field _sourcetype.
* Data from a a renamed sourcetype will only use the search-time configuration for the target sourcetype.
Field extractions (REPORTS/EXTRAXCT) for this stanza sourcetype will be ignored.
* Defaults to empty.

From: http://docs.splunk.com/Documentation/Splunk/5.0.2/Admin/Propsconf

Re: Convert sourcetype

kristian_kolb — Fri, 18 Oct 2013 20:07:30 GMT

yeah, well, no. It's like;

[sourcetype_1] rename = sourcetype_2

The renaming can only be done on a [sourcetype], not a [source::/path/to/file] or a [host::hostname].

Re: Convert sourcetype

sloshburch — Fri, 25 Oct 2013 14:25:13 GMT

Thank you!