Getting Data In

I'm trying to rename a sourcetype, by why isn't my configuration working?

a212830
Champion

Hi,

I want to rename a sourcetype, but the following isn't working:

[log4j]
KV_MODE = auto
ANNOTATE_PUNCT = false
TRANSFORMS-changesourcetype = set_fc_catalina_out

[set_fc_catalina_out]
FORMAT = sourcetype::fc_catalina_out
DEST_KEY = MetaData:Sourcetype

Am I missing something?

0 Karma

NOUMSSI
Builder
# with [<sourcetype>]:
rename = <string>
* Renames [<sourcetype>] as <string>
* With renaming, you can search for the [<sourcetype>] with
sourcetype=<string>
* To search for the original source type without renaming it, use the  field _sourcetype.
* Data from a a renamed sourcetype will only use the search-time configuration for the target
sourcetype. Field extractions (REPORTS/EXTRACT) for this stanza sourcetype will be ignored.
* Defaults to empty.
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

It depends where in the process you are trying to rename this source type. Are you trying to rename this at the search layer or index layer?

What you are doing will rename the source type at parsing / index time.

If you are trying to do this to data that has already been indexed, you simply need to rename the data source:

[log4j]
rename = fc_catalina_out
0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Post your configurations.

0 Karma

a212830
Champion

Doing it at the indexer layer, but it's not working. Would the indexers need to be restarted?

0 Karma

esix_splunk
Splunk Employee
Splunk Employee

Once you change a props / transforms, the indexers do need to be restarted.

0 Karma

a212830
Champion

Tried all this - still no change.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...