Getting Data In

How to send specific logs to a sourcetype?

deepthi5
Path Finder

Hello All,

 

I have query index=xxxx sourcetype=xxx_* NOT(ASA) which actually filters logs that are not ASA from 4 sourcetypes , i want to send these resulted logs to a new sourcetype call xxx_analmoly 

 

Is it possible if yes , how can i achieve this 

Labels (2)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @deepthi5,

no, I'm sorry: when an event is indexed isn't possible to change the sourcetype.

You have to define the new sourcetype rules (regexes) and override the original value before indexing, following the steps described at https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Advancedsourcetypeoverrides#:~:text=You%20ca....

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...