I'm checking out http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/MonitorWindowshostinformation features instead of using my own version.
It looks like the sourcetype cannot be changed on these. Is that accurate? The only option is to use a sourcetype rename? Something like this will not be honored:
[WinHostMon://application] type = application interval = 60 sourcetype = software_inventory_win
I'm guessing I'm missing something here. Anyone have any tips?
This is something that is determined by the input's author. It is in fact possible (as suggested above) to change the sourcetype via a TRANSFORM rule in props.conf. It is also possible for the author of the input to set the sourcetype. This is typically not done, because the inputs are usually paired with a set of rules (field extractions, tags, etc) that operate against a particular sourcetype, as well as searches and dashboards. Since the purpose of a sourcetype is to specify the type of data, and any one input knows its own, it rarely makes sense to allow changes to it.