I have multiple scheduled searches that run on large indexes and save the results to a summary index. There is no aggregation in the searches, only filtering. An example search would be something like "index=http google.com".
My problem is that when I save the search to the summary index the sourcetype is changed to "stash". I would like to keep the old sourcetype. Is there a way to tell Splunk to keep the original sourcetype?
... View more