Sourcetype renaming not taking

[srich]

Following the documentation for sourcetype renaming, I still fail to get it working. I have added an entry in Sourcetype renaming and have created a props.conf file in the etc/system/local directory. I have restarted Splunkd and still zip. I'm running the latest version of Splunk. Help!

props.conf:
[Printer]
rename=System-III

[Printer2]
rename=System-III

[Printer3]
rename=System-III

[Printer-too_small]
rename=System-III

[pgoyal_splunk]

If you have Splunk Enterprise, you can use the rename attribute in props.conf to assign events to a new source type at search time. In case you ever need to search on it, the original source type is moved to a separate field, _sourcetype.
Do the changes on the search Head.

You can also refer to the below link to rename the sourcetype at search time.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Renamesourcetypes

[ewoo]

Sourcetype renaming is a search-time operation. The props.conf with the renamed sourcetype should be placed on your search head. You should be able to observe the renamed sourcetype taking effect immediately by running a search; you do not need to index any new data.

[gnovak]

After i thought this worked, it actually didn't. I have props.conf on all of my main indexers and still i am not seeing the sourcetype renamed. it's still showing up as the old one.

[gnovak]

Actually one thing i just found out. I put the props.conf on the indexer and it appears to be working. At first I put it on the lightweight forwarder.

[gnovak]

I am also seeing the same thing. I have put a props.conf file in /etc/system/local directory and it looks almost identical in the format of the one post by srich. After about an hour I still am not seeing all my sourcetypes renamed. How long does this take?