How to send specific logs to a sourcetype?

[deepthi5]

Hello All,

I have query index=xxxx sourcetype=xxx_* NOT(ASA) which actually filters logs that are not ASA from 4 sourcetypes , i want to send these resulted logs to a new sourcetype call xxx_analmoly 

Is it possible if yes , how can i achieve this 

[gcusello]

Hi @deepthi5,

no, I'm sorry: when an event is indexed isn't possible to change the sourcetype.

You have to define the new sourcetype rules (regexes) and override the original value before indexing, following the steps described at https://docs.splunk.com/Documentation/Splunk/9.0.2/Data/Advancedsourcetypeoverrides#:~:text=You%20ca....

Ciao.

Giuseppe