topic Re: Retrieve original source value after override? in Getting Data In https://community.splunk.com/t5/Getting-Data-In/Retrieve-original-source-value-after-override/m-p/26144#M4288 <P>I was afraid that's the case too. Thanks for confirming ziegfried.</P> Thu, 16 Jun 2011 16:43:49 GMT blee_i365 2011-06-16T16:43:49Z Retrieve original source value after override? https://community.splunk.com/t5/Getting-Data-In/Retrieve-original-source-value-after-override/m-p/26142#M4286 <P>I have overridden the source values from the default log file path to custom names like "AppLog", "MaintenanceLog", etc, through input.conf:</P> <PRE><CODE>[monitor://F:\LOGS] ... source = AppLogs ... </CODE></PRE> <P>Is there a way to retrieve the original value of the source, F:\LOGS\my_original_log_file_name.log ?</P> <P>Thanks in advance!</P> Mon, 28 Sep 2020 09:40:04 GMT https://community.splunk.com/t5/Getting-Data-In/Retrieve-original-source-value-after-override/m-p/26142#M4286 blee_i365 2020-09-28T09:40:04Z Re: Retrieve original source value after override? https://community.splunk.com/t5/Getting-Data-In/Retrieve-original-source-value-after-override/m-p/26143#M4287 <P>No AFAIK this is only possible for the sourcetype field where the original can be retrieved with the _sourcetype field.</P> Thu, 09 Jun 2011 19:39:14 GMT https://community.splunk.com/t5/Getting-Data-In/Retrieve-original-source-value-after-override/m-p/26143#M4287 ziegfried 2011-06-09T19:39:14Z Re: Retrieve original source value after override? https://community.splunk.com/t5/Getting-Data-In/Retrieve-original-source-value-after-override/m-p/26144#M4288 <P>I was afraid that's the case too. Thanks for confirming ziegfried.</P> Thu, 16 Jun 2011 16:43:49 GMT https://community.splunk.com/t5/Getting-Data-In/Retrieve-original-source-value-after-override/m-p/26144#M4288 blee_i365 2011-06-16T16:43:49Z