Haproxy changing source type

alex_guzhavin · ‎02-17-2020

Is it possible to change Haproxy add-on to recognize sourcetype other than haproxy:default(tcp(http)? If so, where can I do it in Splunk cloud. Thanks

codebuilder · ‎03-16-2020

You can always change the sourcetype for data, but it is NOT retroactive. Only new data will be affected. You cannot change the sourcetype of data that has already been indexed.

----
An upvote would be appreciated and Accept Solution if it helps!

Haproxy changing source type

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Join the Conversation

Haproxy changing source type

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence