Sourcetype Override

[kenchisho]

Hi guys... I have a couple of script inputs that generate network status data... the issue is that a single script inputs data for multiple sourcetypes... The data itself has a filed sourcetype=$value$

is there a simple way to override the default sourcetype "exec" like for host override:

[sourcetype-override]
REGEX = (?i)sourcetype=(\w+)
FORMAT = sourcetype::$1
DEST_KEY = MetaData:SourceType

[piebob]

if your events can be identified via regex, you can do this:

http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides

you'll need to do this on the indexer--this won't work on the forwarder, unless it's a 'heavy forwarder'.

[kenchisho]

thnx. i'we seen the guide but this will not work in this case... the examples in the guide match a regex and then based on that match set the source type manually...

[some_stanza]
REGEX = some_regex
FORMAT = sourcetype::my_log (manually set source type to my_log)
DEST_KEY = MetaData:Sourcetype

This would require a stanza in props.conf for every source type i wish to have for a single scripted input source...

what i am trying is to extract the source type itself using a regex and route those events to that source type...