Splunk add-on Builder: Why does the add-on complains when using pretrained sourcetypes in saved searches?

[charliesfx]

I have the following saved search in a Technology Add-on built with the add on builder:
sourcetype=access_combined | stats count as metric_value by method, host

When I run the splunk add-on builder's validation, it warns against using underscores in sourcetype.

Is there a way to alias the access_combined source type to a name that will pass validation, but will still preserve the access_combined source type. Or is there a way to escape the _ so that validation won't complain?

[chli_splunk]

I'm not sure what is "pretrained" sourcetype. Is it provided by Splunk? So you create an add-on without any data input & field extraction s but only saved search?
Firstly the best practice is from Splunk Add-on factory rather than AoB. AoB never creates any rules. That's the best practice how Splunk build add-ons in recent 4 years, and AoB helps your add-ons look like more "Splunk".
Secondly AoB is used to validate new sourcetypes you created in your case. If you are not the owner of the sourcetypes, please just ignore this warning, since it's not an error. Thanks.

[charliesfx]

I'm trying to write searches against the built in "pretrained" source types. Almost all of the splunk pretrained sourcetypes have "_" in the name. Renaming is destructive beyond the plugin so I don't want to do that either. It seems odd that the built in source types directly contradict an add on builder "best practice".

[chli_splunk]

Yes this is just a naming rule of sourcetypes: use ":" instead of "_". If it's a legacy add-on, please ignore this warning since your data already indexed, or rename it in stanza as @lakshman239 mentioned

[lakshman239 · Accepted solution]

I believe Add-on builder uses the naming convention of using ":", e.g. vendor:mysourcetype, so it could complain. ]
In your props.conf, you could try something like to force to use rename [ not a good practice]
[access:combined]
rename = access_combined