Getting Data In

How to modify sourcetype for forwarded windows event

minliang
Loves-to-Learn Lots

For some reason, the sourcetype of my forwarded windows events are now set to WinEventType instead of the usual "Windows:xxx". Where do i change the setting for this?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Sourcetypes are specified in the inputs.conf files on the forwarders. Change them at your peril, however. Your indexers will parse the events based on their sourcetype so changing to an arbitrary type may prevent Splunk from extracting fields.
If you're using Splunk's add-on for Windows, know that version 6.0.0 changed the sourcetypes and that source is now used to distinguish security events from other events. See the app's documentation.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...