The Microsoft Azure Add on for Splunk allows me to enter a custom sourcetype name. How is this accomplished in the conf files. I do not see a custom props or transforms created. Just wondering how this works so I can add it to one of my custom apps. This is impressive.
So for azure:eventhub, as an example, If i name it azure:eventhub:sub001 in the gui, which allows me to search and report easier; i only see azure:eventhub defined in the default/props; however i do not see a custom local/props.conf ; only the custom local/inputs.conf
