https://community.splunk.com/t5/Getting-Data-In/How-to-modify-sourcetype-for-forwarded-windows-event/m-p/480635#M82410 <P>For some reason, the sourcetype of my forwarded windows events are now set to WinEventType instead of the usual "Windows:xxx". Where do i change the setting for this? </P> Sun, 19 Apr 2020 14:29:31 GMT minliang 2020-04-19T14:29:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-modify-sourcetype-for-forwarded-windows-event/m-p/480635#M82410 <P>For some reason, the sourcetype of my forwarded windows events are now set to WinEventType instead of the usual "Windows:xxx". Where do i change the setting for this? </P> Sun, 19 Apr 2020 14:29:31 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-modify-sourcetype-for-forwarded-windows-event/m-p/480635#M82410 minliang 2020-04-19T14:29:31Z https://community.splunk.com/t5/Getting-Data-In/How-to-modify-sourcetype-for-forwarded-windows-event/m-p/480636#M82411 <P>Sourcetypes are specified in the inputs.conf files on the forwarders. Change them at your peril, however. Your indexers will parse the events based on their sourcetype so changing to an arbitrary type may prevent Splunk from extracting fields.<BR /> If you're using Splunk's add-on for Windows, know that version 6.0.0 changed the sourcetypes and that source is now used to distinguish security events from other events. See the app's documentation.</P> Sun, 19 Apr 2020 17:28:53 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-modify-sourcetype-for-forwarded-windows-event/m-p/480636#M82411 richgalloway 2020-04-19T17:28:53Z