https://community.splunk.com/t5/Getting-Data-In/How-to-change-key-value-pair-auto-extraction-if-you-are-getting/m-p/109385#M23014 <P>Is there any possibility to keep the same sourcetype ?</P> Mon, 29 Dec 2014 06:56:57 GMT splunker12er 2014-12-29T06:56:57Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-key-value-pair-auto-extraction-if-you-are-getting/m-p/109383#M23012 <P>The stash source type that you get when you use the collect command appears to have key value pair auto extraction off.</P> Wed, 03 Sep 2014 14:51:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-key-value-pair-auto-extraction-if-you-are-getting/m-p/109383#M23012 starcher 2014-09-03T14:51:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-key-value-pair-auto-extraction-if-you-are-getting/m-p/109384#M23013 <P>If you want to change that, it just add the following in your props.conf</P> <P>[stash]<BR /> KV_MODE = auto</P> <P>Alternatively if you pipe any of your searches through the extract command before operating on fields, that will also work.</P> Wed, 03 Sep 2014 14:52:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-key-value-pair-auto-extraction-if-you-are-getting/m-p/109384#M23013 starcher 2014-09-03T14:52:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-change-key-value-pair-auto-extraction-if-you-are-getting/m-p/109385#M23014 <P>Is there any possibility to keep the same sourcetype ?</P> Mon, 29 Dec 2014 06:56:57 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-change-key-value-pair-auto-extraction-if-you-are-getting/m-p/109385#M23014 splunker12er 2014-12-29T06:56:57Z