Why is Fortinet sourcetype renaming not working?

[aamer86]

Hi, 

I have clustered multi-site indexing architecture with search head cluster. 

I am getting the fortinet logs as below: 

Fortinet ==> Syslog ==> HF monitor the logs >> Indexers (index discovery)

I installed the fortinet add-on on all indexers and searchheads 
I still see logs coming under the sourcetype I defined in the inputs.conf for monitoring 

I added below a list of apps I pushed to Peers and SHs

@fortinet  @fortinet1  

Screenshot 2022-02-18 at 22.00.40.pngScreenshot 2022-02-18 at 22.01.08.png

[richgalloway]

1.  How are you trying to rename the sourcetype?

2. The TAs should be installed on the HF, too.

[aamer86 · Accepted solution]

Thanks @richgalloway  installing the Add-On on the HF fixed it