topic Re: Rename sourcetype for only one app in Getting Data In

Rename sourcetype for only one app

christopherutz — Fri, 13 Aug 2010 02:10:03 GMT

We are standardizing some sourcetype names and had the idea to provide a "compatibility" app in which users could run searches on the old sourcetypes if needed. To implement this we setup a rename stanza for our sourcetype in the props.conf file for our compatibility app as suggested in this thread http://answers.splunk.com/questions/4940/sourcetype-aliasing.

[new_sourcetype_name]
rename=old_sourcetype_name

It seems that even though the rename is specified within an app it is applied globally. Searches run in the default search app (or other apps we have created) require the use of the renamed sourcetype.

The hope is that searches in all other apps could be performed on sourcetype=new_sourcetype_name but users could search for sourcetype=old_sourcetype_name via the compatibility app.

Chris

Re: Rename sourcetype for only one app

ziegfried — Fri, 13 Aug 2010 02:36:54 GMT

Haven't done it before, but try putting the following in the metadata/local.meta in your app directory:

[props]
export = none

Re: Rename sourcetype for only one app

christopherutz — Fri, 13 Aug 2010 02:47:01 GMT

This appears to be the solution. Things are functioning as desired now. Thank you very much!

Re: Rename sourcetype for only one app

Lowell — Sat, 14 Aug 2010 02:30:01 GMT

I think you could further refine this so that you are only blocking the sourcetype rename by changing [props] to [props/new_sourcetype_name/rename], just FYI. This would be helpful if you need other props.conf settings but simply wanted to block the rename itself.