Windows Event Log Sourcetype Overrride

[Wallen]

I have the following on my indexer's props.conf:

[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
sourcetype = WinPrintMon

However, both the source and sourcetype in the events still come up as "WinEventLog:Microsoft-Windows-PrintService/Operational". According to the props.conf documentation I shouldn't have to build a regex and a transform in order to rename this sourcetype.

What am I doing wrong?

[strive]

I converted my comment to answer. See if you can add your comment below to the answer

[strive · Accepted solution]

Try this:
In transforms.conf
[set_sourcetype_WinEventLog]
REGEX =
FORMAT = sourcetype::WinPrintMon
DEST_KEY = MetaData:Sourcetype

In props.conf
[source::WinEventLog:Microsoft-Windows-PrintService/Operational]
TRANSFORMS-changesourcetype = set_sourcetype_WinEventLog

Note: write your regex

[Wallen]

It works with a Regex = \w*, however that doesn't explain why the props.conf docs state you don't need a transform when based on source. I'll mark this as the answer anyway. Thanks.