Getting Data In

How to change sourcetype for HEC data input?

jwalzerpitt
Influencer

In my Splunk Cloud instance, I am ingesting WAF security events from a SaaS service via HEC. The events are in JSON format so my HEC data input is configured as a sourcetype of _json.

I now need to ingest the WAF request events from the Saas service, which are also in JSON format, so I'd like to send those to the same index, but with a different sourcetype to distinguish the two types of events. 

How can I modify the sourcetype for the WAF security events  from _json to waf_sec and then create a new HEC data input for the WAF request events with a sourcetype of waf_req, yet retaining the JSON format?

Thx

Labels (1)
Tags (4)
0 Karma
1 Solution

scelikok
SplunkTrust
SplunkTrust

Hi @jwalzerpitt,

Since it may not be easy to default _json sourcetype, you can filter waf_sec events using the source field. Filtering events by the source field is efficient like sourcetype. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

View solution in original post

scelikok
SplunkTrust
SplunkTrust

Hi @jwalzerpitt,

Since it may not be easy to default _json sourcetype, you can filter waf_sec events using the source field. Filtering events by the source field is efficient like sourcetype. 

If this reply helps you an upvote and "Accept as Solution" is appreciated.

jwalzerpitt
Influencer

TYVM for the reply and info / so basically I'll be ingesting security and request events into the same index with the same sourcetype, but using the source name to distinguish between the two as I can name the HEC data input for WAF requests differently, which will then allow me to filter (and tag) security and requests.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...