index name = my_index
source name = my_source
sourcetype = my_sourcetpye
host = 192.168.0.10
-----------------------------
The field action is =allow -> my_allow.
Action = deny -> my_deny
other -> my_myontype
I want to change it to this.
help me
If I understood right your request you could do it with props.conf and transforms.conf (you need both). Look e.g. CLONE_SOURCETYPE for that. If there are lot of those values then it could be hard to manage all those versions.
Hi
In splunk concept sourcetype means lexical format of log event/source. Based on that it's not a good practice to name sourcetype by value of field (if I understood right what you are asking?). Instead of sourcetype you should use eventtype to separate those events inside sourcetype.
r. Ismo
I want to separate data whenever it comes in. Can similar effects be achieved using prop.conf or transaction.conf?
If I understood right your request you could do it with props.conf and transforms.conf (you need both). Look e.g. CLONE_SOURCETYPE for that. If there are lot of those values then it could be hard to manage all those versions.