I have some apache access logs coming in that I'd like to label
sourcetype="aem:access" instead of
sourcetype=access_combined. How do I apply the
sourcetype=access_combined default extractions to
This is an in-built sourcetype, so you'd find it in $SPLUNKHOME/etc/system/default/props.conf. When you're going to create your custom sourcetype, place your props.conf on $SPLUNKHOME/etc/apps under some app. Do not modify $SPLUNK_HOME/etc/system/default/props.conf.
$SPLUNK_HOME/etc/apps/search/local/props.conf is probably a better place for global app settings.
Please keep in mind that
$SPLUNK_HOME/etc/system/default/props.conf refers to
$SPLUNK_HOME/etc/system/default/transforms.conf as well.
You will find Sourcetype Renaming option in Settings --> Fields menu path. Select the Destination App and provide the name of current sourcetype, _newname in your case, and the new sourcetype as newname and click Save.
You can use rename field in props.conf and change the source-type.