The sourcetype of WinEventLog:* events is set by props/transforms. (In the current of the Splunk for Windows app, at least. I would expect certain future versions to be rewritten to use modular inputs. It is possible that some versions also used the ***SPLUNK*** header processing. This mechanism is described here: http://docs.splunk.com/Documentation/Splunk/5.0/Data/Assignmetadatatoeventsdynamically and is controlled by the HEADER_MODE setting in props.conf, in conjunction with data added to the input stream by the collection program.) The only way you can really modify it effectively would be to use props/transforms.