KiwiSyslog with Splunk

[sherrysafdar]

I have a syslog server and all the syslogs are currently going to KiwiSyslog. I have the Splunk Enterprise addition and would like to get data from KiwiSyslog server. I have already installed Splunk Universal Forwarder and I can see the data in the Splunk.

The question is how can I change the sourcetype or sourcename and call it instead of source="F:\Syslog\Cisco\Switches\xyz.log to something like _sourcetype="CISCO_SWITCHES"

Please advise!

Thanks,