Combine Multiple Source Types with Rename Function

[stevenpall]

I have a number of duplicate source types with names like "access-1", "access-2", etc. I would like to combine these into one source type ("access", for example) using the rename function in the props.conf file.

I've successfully been able to do this with single source types (changing "access-1" to "access", for example), however when I try to make multiple entries with the same source type as seen below, Splunk creates separate source types called "access".

[access-1]
rename=access

[access-2]
rename=access

According to this page, "multiple source types can share the same name", so I believe what I want to do should be possible. Would I need to use regular expressions in a single rename statement to get this working? Is there some other way to do this?

Thanks!

[sblake_splunk · Accepted solution]

Try using a wildcard match on source to rename:

[source::...access*.log]
sourcetype = access

[sblake_splunk]

props.conf

Reindexing is more complex. You would have to remove the old and then reindex it all to set the sourcetype at index time properly. You can set the sourcetype on index time with a setting in inputs.conf for the monitor stanza (the easiest method) or you can get a little more complex with doing event inspection and overriding it before index time: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

[timhavens]

What file is this added to?

And how can I re-index things this would affect?

[stevenpall]

This works for newly collected data, though old data needs to be re-indexed to match the sourcetype.