Why are the Index and SourceType names in our Active Directory forests not matching?

[johannterc]

We have two Active Directory forests in our enterprise with Universal Forwarders installed on all of our domain controllers. The sourcetype and index names in one forest do not match up with the sourcetype and index names of the other forest. Why is that and how can I get the names to be the same? I don't want to have to build different reports for the same thing because the sourcetype and index names are different.

SourceType name in Forest A: "wineventlog"
SourceType name in Forest B: "main"

Index name in Forest A --> "XmlWinEventLog: Security"
Index name in Forest B --> "WinEventLog:Security"

[DalJeanis]

Looks like B is using the default config files. If you want the two to match, you have two ways to do it. Either you can change the data in the config files at the source, or at the forwarder, or you can override the metadata at index time.

There are a lot of examples of the last method on the site. Here's one to get you started, just in case you can't get the authority and agreement to fix the default config files on your forest B.

https://answers.splunk.com/answers/507081/rename-index-based-on-host-and-index-name.html#comment-506...

[johannterc]

I believe my UFs are sending data straight to the Indexer therefore I would want to make modifications to the indexer right? I have been looking over the links but still not 100% clear what to change and I don't want to break anything

[lznger88_2]

hey johannterc, did you find a resolution?

I have a similar problem where my wineventlog:security logs are being sent to index=wineventlog (which is what I want and have configured in the inputs.conf), and to index=main but in xml format (which I don't want)