Convert a Sourcetype

[dwilson333]

All,

I only use Splunk about once a month, tops. So Please help me out if I use the wrong terms.

I have a "app" which was written by my boss that is pulling in logs from our Siebel CRM servers. it does not specify a sourcetype in the inputs.conf file. My boss would like me to create a sourcetype for Siebel data.

1) How do I create a "sourcetype"
2) How do I convert the old automagically created sourcetype to my new one?

[rroberts · Accepted solution]

1.Splunk automagically sourcetypes some input methods (not all ie TCP, UDP) as data comes into Splunk at Index time. Check out:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter

However, as you state, one of the places you can override automatic sourcetyping is in your inputs.conf file.

2.Since sourcetype is an indexed field you would have to clean out the index and re-index the data with your inputs.conf edits. This may not be practical in a production environment, original data sources, missing, etc ...

You should probably leverage sourcetype renaming (aliasing) instead for your boss. This can done via your Manager view -> Fields view -> sourcetype renaming. It is retroactive and takes place at search time. This "renamed field" would also be a knowledge object that could be private just for your boss, anyone with access to the app or global.

http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Renamesourcetypes