How to rename sourcetype at index time?

[rsannala]

Hi Experts,

I would like rename sourcetype at index time with below config.

props.conf

[source::test/source.txt]

TRANSFORMS-sourcetype = newsourcetype

Transforms.conf

[newsourcetype]

SOURCE_KEY = MetaData:Sourcetype
REGEX = regex to match existing sourcetype
FORMAT = newsourcetype
DEST_KEY = MetaData:Sourcetype

Now I would like apply below settings on new sourcetype. 

[newsourcetype]

TZ=

Linebreaker=
Truncate=

etc..

will it work this way ? Please let me know.

Thanks.

Ram

[gcusello]

Hi @rsannala,

yes it's possible as described at https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

remember that you have to perform this transformation on the first Splunk full instance, an Heavy Forwarder (if present) or an Indexer.

Ciao.

Giuseppe