How do I change the sourcetype for evenets from Windows eventlog, it is usualy WinEventLog:, where logname may be for exameple System or Application. In the following inputs.conf configuration
disabled = 0
the events arrive with a sourcetype of WinEventLog:System instead of tidal_evtl.
Well this will not solve my problem, I have to assign different source types to the same event log on different servers, so I have to change it on the forwarder, not on the indexer.
I know not the proper way to do it in Splunk, but his is an app I inherited which relays on this.