I created a stream for netflow and the sourcetype comes in as stream:netflow. Is there a way to change the sourcetype prior to it being ingested into splunk
thanks
ed
you can modify it like any other sourcetype .... make sure that you address all the right stanzas with the new sourcetype name so your field extractions and knowledge object will work
Hello,
I am assuming that you are referring to using props and transforms to change the sourcetype. Am I wrong?
So I would use the current sourcetype in props.conf
[stream:netflow]
TRANSFORMS-set_sourcetype = set_netscaler
Then I would setup the transforms.conf
[set_netscaler]
FORMAT = sourcetype::citrix_netscaler_netflow
DEST_KEY = MetaData:Source
But that would change the sourcetype for all data that comes in via the original sourcetype stream:netflow.
Thanks
ed