topic Re: How to override Source Type for Windows Eventlog in Getting Data In https://community.splunk.com/t5/Getting-Data-In/How-to-override-Source-Type-for-Windows-Eventlog/m-p/51493#M9889 <P>Well this will not solve my problem, I have to assign different source types to the same event log on different servers, so I have to change it on the forwarder, not on the indexer. <BR /> I know not the proper way to do it in Splunk, but his is an app I inherited which relays on this.</P> Tue, 05 Mar 2013 14:37:01 GMT FritzWittwer_ol 2013-03-05T14:37:01Z How to override Source Type for Windows Eventlog https://community.splunk.com/t5/Getting-Data-In/How-to-override-Source-Type-for-Windows-Eventlog/m-p/51491#M9887 <P>How do I change the sourcetype for evenets from Windows eventlog, it is usualy WinEventLog:<LOGNAME>, where logname may be for exameple System or Application. In the following inputs.conf configuration<BR /> <CODE><BR /> [WinEventLog:System]<BR /> sourcetype=tidal_evtl<BR /> disabled = 0</CODE></LOGNAME></P> <P>the events arrive with a sourcetype of WinEventLog:System instead of tidal_evtl.</P> Tue, 05 Mar 2013 13:57:21 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-Source-Type-for-Windows-Eventlog/m-p/51491#M9887 FritzWittwer_ol 2013-03-05T13:57:21Z Re: How to override Source Type for Windows Eventlog https://community.splunk.com/t5/Getting-Data-In/How-to-override-Source-Type-for-Windows-Eventlog/m-p/51492#M9888 <P>Using the props.conf file on the indexer might be the way to go. The following should make everything with a source of WinEventLog:System have a sourcetype of tidal_evtl.</P> <PRE><CODE>[source::WinEventLog:System] sourcetype = tidal_evtl </CODE></PRE> Tue, 05 Mar 2013 14:18:40 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-Source-Type-for-Windows-Eventlog/m-p/51492#M9888 treinke 2013-03-05T14:18:40Z Re: How to override Source Type for Windows Eventlog https://community.splunk.com/t5/Getting-Data-In/How-to-override-Source-Type-for-Windows-Eventlog/m-p/51493#M9889 <P>Well this will not solve my problem, I have to assign different source types to the same event log on different servers, so I have to change it on the forwarder, not on the indexer. <BR /> I know not the proper way to do it in Splunk, but his is an app I inherited which relays on this.</P> Tue, 05 Mar 2013 14:37:01 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-Source-Type-for-Windows-Eventlog/m-p/51493#M9889 FritzWittwer_ol 2013-03-05T14:37:01Z