WinEventLog define sourcetype on forwarder

[tprzelom]

How do I change the sourcetype for events from Windows eventlog, it is usually WinEventLog:, where logname may be for example System or Application. In the following inputs.conf configuration
[WinEventLog:System]
sourcetype=win_clients
disabled = 0

the events arrive with a sourcetype of WinEventLog:System instead of win_clients.

[Lowell]

Try changing the source as well. It's possible that your events are matching a [source::WinEventLog:*](or similar) stanza in a props.conf file. Some of these contain TRANSFORMS entries that will automatically set (or in your case reset) the sourcetype. Other possibilities depend on your setup. For example, if your input is on a Universal Forwarder, then much of this will depend on the settings on your indexer (or whatever Splunk instances that is receiving the events) may be changing the sourcetype based on a configuration there.

If you could provide additional details about (1) the Splunk version you are running, (2) Which Windows apps (or TAs) you have installed, and (3) your environment (do you have forwarders, or are you on a single box, ...)