https://community.splunk.com/t5/Getting-Data-In/TCP-input-override/m-p/505731#M86139 <P>Yes, it is possible. Note, it may cause excessive CPU usage on the indexer / heavy forwarder.&nbsp;&nbsp;<BR />&nbsp;&nbsp;<BR />props.conf and transforms.conf (most likely on indexer, but if you have the data coming to a heavy forwarder, then put the props and transforms there as well)<BR /><BR />In the transforms example below, adjust the regex to grab the field you are looking for.&nbsp;<BR /><BR />For More details, see:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Advancedsourcetypeoverrides" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Advancedsourcetypeoverrides</A>&nbsp;</P><P>props.conf<BR />[&lt;sourcetype&gt;]<BR />TRANSFORMS-changedatasource = datasource_finder</P><P>transforms.conf<BR />[datasource_finder]<BR />SOURCE_KEY = _raw<BR />REGEX = datasource=(\w+)<BR />DEST_KEY = MetaData:Sourcetype<BR />FORMAT = sourcetype::$1</P> Tue, 23 Jun 2020 12:52:40 GMT The_Simko 2020-06-23T12:52:40Z https://community.splunk.com/t5/Getting-Data-In/TCP-input-override/m-p/505707#M86138 <P>Hi,</P><P>I am using a TCP input in splunk to receive WSUS data, gathered and pushed to splunk by a powershell script.&nbsp;<BR /><BR />My question is if it is possible to use the same input, and override source type based on a field value in the received data? I have field called "datasource" in my data.</P> Tue, 23 Jun 2020 11:26:09 GMT https://community.splunk.com/t5/Getting-Data-In/TCP-input-override/m-p/505707#M86138 hethu 2020-06-23T11:26:09Z https://community.splunk.com/t5/Getting-Data-In/TCP-input-override/m-p/505731#M86139 <P>Yes, it is possible. Note, it may cause excessive CPU usage on the indexer / heavy forwarder.&nbsp;&nbsp;<BR />&nbsp;&nbsp;<BR />props.conf and transforms.conf (most likely on indexer, but if you have the data coming to a heavy forwarder, then put the props and transforms there as well)<BR /><BR />In the transforms example below, adjust the regex to grab the field you are looking for.&nbsp;<BR /><BR />For More details, see:&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Advancedsourcetypeoverrides" target="_blank">https://docs.splunk.com/Documentation/Splunk/8.0.4/Data/Advancedsourcetypeoverrides</A>&nbsp;</P><P>props.conf<BR />[&lt;sourcetype&gt;]<BR />TRANSFORMS-changedatasource = datasource_finder</P><P>transforms.conf<BR />[datasource_finder]<BR />SOURCE_KEY = _raw<BR />REGEX = datasource=(\w+)<BR />DEST_KEY = MetaData:Sourcetype<BR />FORMAT = sourcetype::$1</P> Tue, 23 Jun 2020 12:52:40 GMT https://community.splunk.com/t5/Getting-Data-In/TCP-input-override/m-p/505731#M86139 The_Simko 2020-06-23T12:52:40Z