So with the above, configurations, I am able to reset the sourcetype to interfaces and that works, however, when I look at the data in splunk it is duplicated. That is, if I pass in 1 record and do .... | stats count by id - it returns 2 instead of 1.
In this instance there is no sourcetype interfaces defined in the props.conf, so although I can change the sourcetype to interfaces, that type doesnt actually defined anywhere.
If I create the sourcetype interfaces, it all works fine.
You ask, why not just create the type if that makes it work ?
Well, I dont know what types are likely to come into the system, so I am trying to make it completely dynamic in nature.
I dont know if the problem is due to the INDEXED_EXTRACTION not being known, or its set to a default that is not json - or if there is some other metadata value I need to change to tell splunk the format and only to create 1 record.
Or worst case, I have to predefine all possible sourcetypes - even though that are all json in nature.