inputs..conf and sourcetypes - Can't override the sourcetype

[robsenk]

We have the need to set a high level sourcetype in the inputs.conf to one sourcetype and override some of those sources using the prop.conf and provide a more meaningful sourcetype. This didn't work however, when I removed the sourcetype from the inputs.conf the props.conf went ahead and overrode the the automatic designation splunk assigned as expected.

The goal is to set all data to one sourcetype with inputs.conf and override sourcetypes for selected files with a specific info in the props.conf.

Note that we are indexing archive files directly that have several levels.

Should this be possible?

Splunk 5.0.4 build 172409.

[rakesh_498115]

Hi robsenk..

if you wish to change to change all the sourcetypes to a common sourcetype. you can use the rename property in props.conf

[sourcetype1]
rename = CommonSourcetype

[sourcetype2]
rename = CommonSourcetype

[sourcetype3]
rename = CommonSourcetype

Hope this helps !!

[robsenk]

Thanks for the comment. I'm actually trying to change from a common sourcetype assigned in inputs to a sourcetype defined in the props.conf. It will not override the sourcetype defined in inputs.conf.

The reason we are assigning a common type in inputs.conf is because the auto assignment for sourcetype feature goes wild on our dataset.

[walterk82]

Did you resolve this question?