1.Splunk automagically sourcetypes some input methods (not all ie TCP, UDP) as data comes into Splunk at Index time. Check out: http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter However, as you state, one of the places you can override automatic sourcetyping is in your inputs.conf file. 2.Since sourcetype is an indexed field you would have to clean out the index and re-index the data with your inputs.conf edits. This may not be practical in a production environment, original data sources, missing, etc ... You should probably leverage sourcetype renaming (aliasing) instead for your boss. This can done via your Manager view -> Fields view -> sourcetype renaming. It is retroactive and takes place at search time. This "renamed field" would also be a knowledge object that could be private just for your boss, anyone with access to the app or global. http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Renamesourcetypes ... View more