topic Re: Change WinHostMon sourcetype in Getting Data In

Change WinHostMon sourcetype

sloshburch — Fri, 04 Apr 2014 19:05:10 GMT

I'm checking out http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/MonitorWindowshostinformation features instead of using my own version.

It looks like the sourcetype cannot be changed on these. Is that accurate? The only option is to use a sourcetype rename? Something like this will not be honored:

[WinHostMon://application]
    type = application
    interval = 60
    sourcetype = software_inventory_win

I'm guessing I'm missing something here. Anyone have any tips?

Re: Change WinHostMon sourcetype

somesoni2 — Fri, 04 Apr 2014 19:38:34 GMT

Looks like sourcetype renaming is the only option for specific data inputs like scripted input , Windows Event monitoring and this one.

Re: Change WinHostMon sourcetype

linu1988 — Fri, 04 Apr 2014 19:40:37 GMT

props.conf at indexer to change it...

Re: Change WinHostMon sourcetype

gkanapathy — Mon, 07 Apr 2014 02:05:11 GMT

That is correct, you can't set a new sourcetype for certain input types.

Re: Change WinHostMon sourcetype

sloshburch — Mon, 14 Apr 2014 15:35:17 GMT

Thanks for the clear answer. Is this a limitation of the Windows App or splunk enterprise?

Re: Change WinHostMon sourcetype

gkanapathy — Mon, 14 Apr 2014 15:43:25 GMT

This is something that is determined by the input's author. It is in fact possible (as suggested above) to change the sourcetype via a TRANSFORM rule in props.conf. It is also possible for the author of the input to set the sourcetype. This is typically not done, because the inputs are usually paired with a set of rules (field extractions, tags, etc) that operate against a particular sourcetype, as well as searches and dashboards. Since the purpose of a sourcetype is to specify the type of data, and any one input knows its own, it rarely makes sense to allow changes to it.