https://community.splunk.com/t5/Getting-Data-In/Create-aliases-for-common-sourcetypes/m-p/157848#M31973 <P>I'd like to create a custom name for a common sourcetype. For instance:</P> <H1>inputs.conf</H1> <P>[monitor:///my/special/directory]<BR /> sourcetype = custom_syslog</P> <H1>props.conf</H1> <P>[custom_syslog]</P> <H1>Some configuration to make this custom sourcetype</H1> <H1>format logs like the syslog sourcetype would be</H1> <H1>formatted</H1> <P>[source::/my/special/directory]<BR /> sourcetype = custom_syslog</P> <P>Rename does this in the reverse. I could rename my custom field to syslog with 'rename = syslog' in my props.conf, but that wouldn't help me. I want the behavior, but not the name of the default sourcetypes.</P> Fri, 12 Dec 2014 20:09:00 GMT carmitstead 2014-12-12T20:09:00Z https://community.splunk.com/t5/Getting-Data-In/Create-aliases-for-common-sourcetypes/m-p/157848#M31973 <P>I'd like to create a custom name for a common sourcetype. For instance:</P> <H1>inputs.conf</H1> <P>[monitor:///my/special/directory]<BR /> sourcetype = custom_syslog</P> <H1>props.conf</H1> <P>[custom_syslog]</P> <H1>Some configuration to make this custom sourcetype</H1> <H1>format logs like the syslog sourcetype would be</H1> <H1>formatted</H1> <P>[source::/my/special/directory]<BR /> sourcetype = custom_syslog</P> <P>Rename does this in the reverse. I could rename my custom field to syslog with 'rename = syslog' in my props.conf, but that wouldn't help me. I want the behavior, but not the name of the default sourcetypes.</P> Fri, 12 Dec 2014 20:09:00 GMT https://community.splunk.com/t5/Getting-Data-In/Create-aliases-for-common-sourcetypes/m-p/157848#M31973 carmitstead 2014-12-12T20:09:00Z https://community.splunk.com/t5/Getting-Data-In/Create-aliases-for-common-sourcetypes/m-p/157849#M31974 <P>I am not sure to understand perfectly what you try to do. To me it seems impossible to change de behavior since its linked to a specific set of data. It will always behave as it was doing at the begining<BR /> Please if this is not enought, provide more details </P> Tue, 16 Dec 2014 09:49:01 GMT https://community.splunk.com/t5/Getting-Data-In/Create-aliases-for-common-sourcetypes/m-p/157849#M31974 dounla2carlos 2014-12-16T09:49:01Z