How to modify sourcetype for forwarded windows event

[minliang]

For some reason, the sourcetype of my forwarded windows events are now set to WinEventType instead of the usual "Windows:xxx". Where do i change the setting for this?

[richgalloway]

Sourcetypes are specified in the inputs.conf files on the forwarders. Change them at your peril, however. Your indexers will parse the events based on their sourcetype so changing to an arbitrary type may prevent Splunk from extracting fields.
If you're using Splunk's add-on for Windows, know that version 6.0.0 changed the sourcetypes and that source is now used to distinguish security events from other events. See the app's documentation.