https://community.splunk.com/t5/Getting-Data-In/WinEventLog-define-sourcetype-on-forwarder/m-p/168264#M34056 <P>How do I change the sourcetype for events from Windows eventlog, it is usually WinEventLog:<LOGNAME>, where logname may be for example System or Application. In the following inputs.conf configuration<BR /> [WinEventLog:System]<BR /> sourcetype=win_clients<BR /> disabled = 0</LOGNAME></P> <P>the events arrive with a sourcetype of WinEventLog:System instead of win_clients.</P> Thu, 05 Dec 2013 18:08:38 GMT tprzelom 2013-12-05T18:08:38Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-define-sourcetype-on-forwarder/m-p/168264#M34056 <P>How do I change the sourcetype for events from Windows eventlog, it is usually WinEventLog:<LOGNAME>, where logname may be for example System or Application. In the following inputs.conf configuration<BR /> [WinEventLog:System]<BR /> sourcetype=win_clients<BR /> disabled = 0</LOGNAME></P> <P>the events arrive with a sourcetype of WinEventLog:System instead of win_clients.</P> Thu, 05 Dec 2013 18:08:38 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-define-sourcetype-on-forwarder/m-p/168264#M34056 tprzelom 2013-12-05T18:08:38Z https://community.splunk.com/t5/Getting-Data-In/WinEventLog-define-sourcetype-on-forwarder/m-p/168265#M34057 <P>Try changing the <CODE>source</CODE> as well. It's possible that your events are matching a <CODE>[source::WinEventLog:*]</CODE>(or similar) stanza in a <CODE>props.conf</CODE> file. Some of these contain <CODE>TRANSFORMS</CODE> entries that will automatically set (or in your case reset) the sourcetype. Other possibilities depend on your setup. For example, if your input is on a Universal Forwarder, then much of this will depend on the settings on your indexer (or whatever Splunk instances that is receiving the events) may be changing the sourcetype based on a configuration there.</P> <P>If you could provide additional details about (1) the Splunk version you are running, (2) Which Windows apps (or TAs) you have installed, and (3) your environment (do you have forwarders, or are you on a single box, ...)</P> Mon, 09 Dec 2013 18:02:01 GMT https://community.splunk.com/t5/Getting-Data-In/WinEventLog-define-sourcetype-on-forwarder/m-p/168265#M34057 Lowell 2013-12-09T18:02:01Z