Custom name for Sourcetype

[ghannemann]

Hi

I have a forwarder pushing java log data to an indexer. The inputs on the index was set to log4j. However in the basic summary screen, the sourcetype is shown as server.
Why is this?

Is there anyway to rename this sourcetype, or creating based on an existing one with a different name?

Regards,
Gerhard

[ghannemann]

Whoops, sorry, yes I did mean sourcetype, not index, (had other questions that - mix up of terms). I was trying to see if I could create my own sourcetypes based on existing ones.

[sbrant_splunk]

You can specify the sourcetype in a few places.

On the forwarder, in inputs.conf:

[monitor://path to log file]
sourcetype=log4j

OR

On the indexer, in props.conf:

[source::full path to log file]
sourcetype=log4j

[ghannemann]

Thank you.
I also found it useful to set sourcetype on the forward (universal forwarder) and the receiver as well.

[sbrant_splunk]

Your description is a bit confusing. You say that "the inputs on the index was set to log4j", do you mean that the inputs.conf file on the forwarder, within the stanza collecting this file, has a line that says "sourcetype=log4j"?