Haproxy changing source type

alex_guzhavin · ‎02-17-2020

Is it possible to change Haproxy add-on to recognize sourcetype other than haproxy:default(tcp(http)? If so, where can I do it in Splunk cloud. Thanks

codebuilder · ‎03-16-2020

You can always change the sourcetype for data, but it is NOT retroactive. Only new data will be affected. You cannot change the sourcetype of data that has already been indexed.

----
An upvote would be appreciated and Accept Solution if it helps!

Haproxy changing source type

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Automated Threat Analysis: Available in ES Premier

What’s New in Splunk AI: Volume 02

Best Practices: Splunk auto adjust pipeline queue

Join the Conversation

Haproxy changing source type

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Automated Threat Analysis: Available in ES Premier

What’s New in Splunk AI: Volume 02

Best Practices: Splunk auto adjust pipeline queue