I have a number of duplicate source types with names like "access-1", "access-2", etc. I would like to combine these into one source type ("access", for example) using the rename function in the props.conf file.
I've successfully been able to do this with single source types (changing "access-1" to "access", for example), however when I try to make multiple entries with the same source type as seen below, Splunk creates separate source types called "access".
According to this page, "multiple source types can share the same name", so I believe what I want to do should be possible. Would I need to use regular expressions in a single rename statement to get this working? Is there some other way to do this?
Try using a wildcard match on source to rename:
sourcetype = access
Reindexing is more complex. You would have to remove the old and then reindex it all to set the sourcetype at index time properly. You can set the sourcetype on index time with a setting in inputs.conf for the monitor stanza (the easiest method) or you can get a little more complex with doing event inspection and overriding it before index time: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides