Getting Data In

How to modify sourcetype for forwarded windows event

minliang
Loves-to-Learn Lots

For some reason, the sourcetype of my forwarded windows events are now set to WinEventType instead of the usual "Windows:xxx". Where do i change the setting for this?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sourcetypes are specified in the inputs.conf files on the forwarders. Change them at your peril, however. Your indexers will parse the events based on their sourcetype so changing to an arbitrary type may prevent Splunk from extracting fields.
If you're using Splunk's add-on for Windows, know that version 6.0.0 changed the sourcetypes and that source is now used to distinguish security events from other events. See the app's documentation.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...