Hi gauravmishra15, a bit late for the party ... In Splunk Enterprise under Settings - Source Types you can list, create and edit sourcetypes options in the according props.conf . The docs talk about the process to modify sourcetypes in Splunk Enterprise here http://docs.splunk.com/Documentation/Splunk/latest/Data/Managesourcetypes and for Splunk Cloud here http://docs.splunk.com/Documentation/SplunkCloud/latest/Data/Managesourcetypes Hope this helps ... cheers, MuS ... View more