Getting Data In

Change WinHostMon sourcetype

Ultra Champion

I'm checking out http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/MonitorWindowshostinformation features instead of using my own version.

It looks like the sourcetype cannot be changed on these. Is that accurate? The only option is to use a sourcetype rename? Something like this will not be honored:

[WinHostMon://application]
    type = application
    interval = 60
    sourcetype = software_inventory_win

I'm guessing I'm missing something here. Anyone have any tips?

Tags (3)
0 Karma
1 Solution

Splunk Employee
Splunk Employee

That is correct, you can't set a new sourcetype for certain input types.

View solution in original post

Splunk Employee
Splunk Employee

That is correct, you can't set a new sourcetype for certain input types.

View solution in original post

Splunk Employee
Splunk Employee

This is something that is determined by the input's author. It is in fact possible (as suggested above) to change the sourcetype via a TRANSFORM rule in props.conf. It is also possible for the author of the input to set the sourcetype. This is typically not done, because the inputs are usually paired with a set of rules (field extractions, tags, etc) that operate against a particular sourcetype, as well as searches and dashboards. Since the purpose of a sourcetype is to specify the type of data, and any one input knows its own, it rarely makes sense to allow changes to it.

0 Karma

Ultra Champion

Thanks for the clear answer. Is this a limitation of the Windows App or splunk enterprise?

0 Karma

Champion

props.conf at indexer to change it...

0 Karma

SplunkTrust
SplunkTrust

Looks like sourcetype renaming is the only option for specific data inputs like scripted input , Windows Event monitoring and this one.

0 Karma