https://community.splunk.com/t5/Getting-Data-In/KiwiSyslog-with-Splunk/m-p/382355#M68927 <P>I have a syslog server and all the syslogs are currently going to KiwiSyslog. I have the Splunk Enterprise addition and would like to get data from KiwiSyslog server. I have already installed Splunk Universal Forwarder and I can see the data in the Splunk.</P> <P>The question is how can I change the sourcetype or sourcename and call it instead of source="F:\Syslog\Cisco\Switches\xyz.log to something like _sourcetype="CISCO_SWITCHES"</P> <P>Please advise!</P> <P>Thanks,</P> Tue, 29 Sep 2020 23:14:03 GMT sherrysafdar 2020-09-29T23:14:03Z https://community.splunk.com/t5/Getting-Data-In/KiwiSyslog-with-Splunk/m-p/382355#M68927 <P>I have a syslog server and all the syslogs are currently going to KiwiSyslog. I have the Splunk Enterprise addition and would like to get data from KiwiSyslog server. I have already installed Splunk Universal Forwarder and I can see the data in the Splunk.</P> <P>The question is how can I change the sourcetype or sourcename and call it instead of source="F:\Syslog\Cisco\Switches\xyz.log to something like _sourcetype="CISCO_SWITCHES"</P> <P>Please advise!</P> <P>Thanks,</P> Tue, 29 Sep 2020 23:14:03 GMT https://community.splunk.com/t5/Getting-Data-In/KiwiSyslog-with-Splunk/m-p/382355#M68927 sherrysafdar 2020-09-29T23:14:03Z