Your sourcetypes are found in your inputs.conf files or from anywhere in Splunk Web: Splunk Filesystem $splunk_home$/etc/{application name}/(local OR default)/inputs.conf Splunk Web: select System, and then select Data inputs from the Data section of the System pop-up. This takes you to a page where you can view and manage your existing inputs, as well as add new ones. You'll just change the input for the data to point to new index and have new sourcetype. Check this article out for more details: http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Configureyourinputs ... View more