Getting Data In
Highlighted

Combine Multiple Source Types with Rename Function

New Member

I have a number of duplicate source types with names like "access-1", "access-2", etc. I would like to combine these into one source type ("access", for example) using the rename function in the props.conf file.

I've successfully been able to do this with single source types (changing "access-1" to "access", for example), however when I try to make multiple entries with the same source type as seen below, Splunk creates separate source types called "access".

[access-1]
rename=access

[access-2]
rename=access

According to this page, "multiple source types can share the same name", so I believe what I want to do should be possible. Would I need to use regular expressions in a single rename statement to get this working? Is there some other way to do this?

Thanks!

Tags (1)
0 Karma
Highlighted

Re: Combine Multiple Source Types with Rename Function

Splunk Employee
Splunk Employee

Try using a wildcard match on source to rename:

[source::...access*.log]
sourcetype = access

View solution in original post

0 Karma
Highlighted

Re: Combine Multiple Source Types with Rename Function

New Member

This works for newly collected data, though old data needs to be re-indexed to match the sourcetype.

0 Karma
Highlighted

Re: Combine Multiple Source Types with Rename Function

New Member

What file is this added to?

And how can I re-index things this would affect?

0 Karma
Highlighted

Re: Combine Multiple Source Types with Rename Function

Splunk Employee
Splunk Employee

props.conf

Reindexing is more complex. You would have to remove the old and then reindex it all to set the sourcetype at index time properly. You can set the sourcetype on index time with a setting in inputs.conf for the monitor stanza (the easiest method) or you can get a little more complex with doing event inspection and overriding it before index time: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

0 Karma