All Apps and Add-ons

Splunk Stream change sourcetype

edwardrose
Contributor

I created a stream for netflow and the sourcetype comes in as stream:netflow. Is there a way to change the sourcetype prior to it being ingested into splunk

thanks
ed

0 Karma

adonio
Ultra Champion

you can modify it like any other sourcetype .... make sure that you address all the right stanzas with the new sourcetype name so your field extractions and knowledge object will work

0 Karma

edwardrose
Contributor

Hello,

I am assuming that you are referring to using props and transforms to change the sourcetype. Am I wrong?

So I would use the current sourcetype in props.conf
[stream:netflow]
TRANSFORMS-set_sourcetype = set_netscaler

Then I would setup the transforms.conf
[set_netscaler]
FORMAT = sourcetype::citrix_netscaler_netflow
DEST_KEY = MetaData:Source

But that would change the sourcetype for all data that comes in via the original sourcetype stream:netflow.

Thanks
ed

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...