Change WinHostMon sourcetype

[sloshburch]

I'm checking out http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/MonitorWindowshostinformation features instead of using my own version.

It looks like the sourcetype cannot be changed on these. Is that accurate? The only option is to use a sourcetype rename? Something like this will not be honored:

[WinHostMon://application]
    type = application
    interval = 60
    sourcetype = software_inventory_win

I'm guessing I'm missing something here. Anyone have any tips?

[gkanapathy · Accepted solution]

That is correct, you can't set a new sourcetype for certain input types.

[gkanapathy]

This is something that is determined by the input's author. It is in fact possible (as suggested above) to change the sourcetype via a TRANSFORM rule in props.conf. It is also possible for the author of the input to set the sourcetype. This is typically not done, because the inputs are usually paired with a set of rules (field extractions, tags, etc) that operate against a particular sourcetype, as well as searches and dashboards. Since the purpose of a sourcetype is to specify the type of data, and any one input knows its own, it rarely makes sense to allow changes to it.

[sloshburch]

Thanks for the clear answer. Is this a limitation of the Windows App or splunk enterprise?

[linu1988]

props.conf at indexer to change it...

[somesoni2]

Looks like sourcetype renaming is the only option for specific data inputs like scripted input , Windows Event monitoring and this one.