How to edit my configurations to rename the sourcetype name as the index name?

[vchigurupati]

Hi guys,

1) Index name=A1 sourcetype =B & 2) indexname=A2 sourcetype = B now my task is to rename the sourcetype name as index name for both of them. So, can someone please help me with stanza script that I have to write in props.conf and transforms.conf including with the regular expression? We have 100+ indexes to rename like this. After getting the answer, I will learn and will follow for other index as same.

[woodcock]

Generally both index and sourcetype are set inside of inputs.conf so start there on your Idexers and restart splunk there when updated. That will make the data moving forward be different. As far as the data already indexed, you should use rename sourcetype in props.conf on your Search Heads:

https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Renamesourcetypes

[vchigurupati]

thank you so much, can you please help me on give regex for source /var/log/*/access in such a way that it should extract the source field

[woodcock]

I am very unclear on your goal. I assume that this is true:

You have events coming like this:

DATASET 1: index=A1 sourcetype=B
DATASET 2: index=A2 sourcetype=B
Now I am somewhat guessing. Are you saying that you need to change configurations so that:

DATASET 1: index=B sourcetype=B
DATASET 2: index=B sourcetype=B
The above seems silly because now you cannot easily discriminate between the 2 datasets so perhaps you are saying that you need to change configurations so that:

DATASET 1: index=A1 sourcetype=A1
DATASET 2: index=A2 sourcetype=A2
But again, this seems counter-productive and silly; it is a net loss of discrimination.

So I am assuming that your desire is something else entirely so please do explain. If one of these is what you are asking, then my push-back to you is: WHY? I am sure that whatever you are trying to accomplish can be done without de-discriminating your data.

[vchigurupati]

I do have two indexes A1 and A2 with the same source type name B, now i want to combine both the indexes into one and change the source type for the data from old index(A1) to different name(B1) and same for the data from old index(A2) to different name (B2).So here the scenario looks like:
(Old)
DATASET 1: index=A1 sourcetype=B
DATASET 2: index=A2 sourcetype=B

(New)
DATASET: index=A(data from A1 and A2) sourcetype=B1(for data from old indexA1), B2(for data from old indexA2)

Is there a solution for this as it's already indexed data.

[adonio]

take a look here and apply:
https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html