@beataficek  refer the below Splunk official document to configure the webhook https://help.splunk.com/en/splunk-enterprise/alert-and-respond/alerting-manual/9.4/configure-webhook-allow-list  ... View more

Good that it is all working for you again. It sounds like you were doing the right thing all along and that there was something about your environment at the time which was causing this (intermittent) issue. If it happens again, please provide more detail about your environment (obfuscated, of course), in case there is something that someone could suggest needs tweaking. ... View more

OK. Sourcetype rewriting is one thing but I have a hunch that you're trying to not only get a particular metadata field rewritten but would also like to reprocess whole event with the new sourcetype. And that's (depending on how much "back" you would want to go) is either much more difficult or plain impossible. See here - https://community.splunk.com/t5/Getting-Data-In/Diagrams-of-how-indexing-works-in-the-Splunk-platform-the-Masa/m-p/590774 The event comes through all stages of the ingestion pipeline in sequence and there is no way for an event to "go back". Even if you rewrite the sourcetype, it will still get processed further "down the street" according to the props/transforms from the original sourcetype. The only difference will be that it will be written into the index with the new sourcetype and when you search your data the search-time props for the new sourcetype will be applied. There is one "exception" - if you use CLONE_SOURCETYPE, the event will be "forked" and a new copy with the new sourcetype will be ingested again into the pipeline but it will still be after linebreaking and - as far as I remember - after timestamp parsing. ... View more