Splunk Stream change sourcetype

[edwardrose]

I created a stream for netflow and the sourcetype comes in as stream:netflow. Is there a way to change the sourcetype prior to it being ingested into splunk

thanks
ed

[adonio]

you can modify it like any other sourcetype .... make sure that you address all the right stanzas with the new sourcetype name so your field extractions and knowledge object will work

[edwardrose]

Hello,

I am assuming that you are referring to using props and transforms to change the sourcetype. Am I wrong?

So I would use the current sourcetype in props.conf
[stream:netflow]
TRANSFORMS-set_sourcetype = set_netscaler

Then I would setup the transforms.conf
[set_netscaler]
FORMAT = sourcetype::citrix_netscaler_netflow
DEST_KEY = MetaData:Source

But that would change the sourcetype for all data that comes in via the original sourcetype stream:netflow.

Thanks
ed