Following the documentation for sourcetype renaming, I still fail to get it working. I have added an entry in Sourcetype renaming and have created a props.conf file in the etc/system/local directory. I have restarted Splunkd and still zip. I'm running the latest version of Splunk. Help!
I am also seeing the same thing. I have put a props.conf file in /etc/system/local directory and it looks almost identical in the format of the one post by srich. After about an hour I still am not seeing all my sourcetypes renamed. How long does this take?
After i thought this worked, it actually didn't. I have props.conf on all of my main indexers and still i am not seeing the sourcetype renamed. it's still showing up as the old one.
Sourcetype renaming is a search-time operation. The props.conf with the renamed sourcetype should be placed on your search head. You should be able to observe the renamed sourcetype taking effect immediately by running a search; you do not need to index any new data.
If you have Splunk Enterprise, you can use the rename attribute in props.conf to assign events to a new source type at search time. In case you ever need to search on it, the original source type is moved to a separate field, _sourcetype.
Do the changes on the search Head.
You can also refer to the below link to rename the sourcetype at search time.