Splunk® Enterprise

Getting Data In

Acrobat logo Download manual as PDF


Splunk Enterprise version 6.x is no longer supported as of October 23, 2019. See the Splunk Software Support Policy for details. For information about upgrading to a supported version, see How to upgrade Splunk Enterprise.
Acrobat logo Download topic as PDF

Rename source types at search time

You might encounter situations where you want to rename a source type. For example, say you accidentally assigned an input to the wrong source type. Or you realize that two differently named source types actually need to be handled the same way at search time.

If you use Splunk Enterprise, you can add the rename setting in the props.conf configuration file to assign events to a new source type at search time. If you need to search on it, Splunk Enterprise moves the original source type to a separate field, called _sourcetype.

On Splunk Cloud, you must open a support ticket to rename source types, as the props.conf file is not available for editing on a Splunk Cloud instance and using a heavy forwarder is not possible as renaming source types is only applicable on data that you have already indexed.

The indexed events still contain the original source type name. The renaming of source types occurs only at search time. Also, renaming the source type does only that. It doesn't fix problems with the indexed format of your event data that were caused by assigning the wrong source type in the first place.

To rename the source type, add the rename setting to your source type stanza in the props.conf file: 

rename = <string>

A source type name can only contain the letters a through z, the numerals 0 through 9, the colon ( : ) character, and the underscore ( _ ) character.

For example, say you're using the source type cheese_shop for your application server. Then you accidentally index a bunch of data as source type whoops. You can rename whoops to cheese_shop with the following stanza in the props.conf file: 

[whoops]
rename=cheese_shop

Now, a search on cheese_shop returns all the whoops events as well as any events that had the cheese_shop source type: 

sourcetype=cheese_shop

If you ever need to single out the whoops events, you can use _sourcetype in your search: 

_sourcetype=whoops

Data from a renamed source type uses only the search-time configuration for the target source type, in this example it is cheese_shop. The Splunk platform ignores any field extractions for the original source type.

Last modified on 31 March, 2021
PREVIOUS
Manage source types 		  NEXT
About event segmentation

This documentation applies to the following versions of Splunk® Enterprise: 6.3.0, 6.3.2, 6.3.3, 6.3.4, 6.3.5, 6.3.6, 6.3.7, 6.3.8, 6.3.9, 6.3.10, 6.3.11, 6.3.12, 6.3.13, 6.3.14, 6.4.0, 6.4.1, 6.4.2, 6.4.3, 6.4.4, 6.4.5, 6.4.6, 6.4.7, 6.4.8, 6.4.9, 6.4.10, 6.4.11, 6.5.0, 6.5.1, 6.5.2, 6.5.3, 6.5.4, 6.5.5, 6.5.6, 6.5.7, 6.5.8, 6.5.9, 6.5.10, 6.6.0, 6.6.1, 6.6.2, 6.6.3, 6.6.4, 6.6.5, 6.6.6, 6.6.7, 6.6.8, 6.6.9, 6.6.10, 6.6.11, 6.6.12, 7.0.0, 7.0.1, 7.0.2, 7.0.4, 7.0.6, 7.0.10, 7.0.11, 7.0.13, 6.3.1, 7.0.3, 7.0.9, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.4, 7.1.5, 7.1.6, 7.1.7, 7.1.8, 7.1.9, 7.1.10, 7.2.0, 7.2.1, 7.2.2, 7.2.3, 7.2.4, 7.2.5, 7.2.6, 7.2.7, 7.2.8, 7.2.9, 7.2.10, 7.3.0, 7.3.1, 7.3.2, 7.3.3, 7.3.4, 7.3.5, 7.3.6, 7.3.7, 7.3.8, 7.3.9, 8.0.0, 8.0.1, 8.0.2, 8.0.3, 8.0.4, 8.0.5, 8.0.6, 8.0.7, 8.0.8, 8.0.9, 8.1.0, 8.1.1, 8.1.2, 8.1.3, 8.1.4, 8.2.0, 7.0.5, 7.0.7, 7.0.8

Was this documentation topic helpful?

You must be logged into splunk.com in order to post comments. Log in now.

Please try to keep this discussion focused on the content covered in this documentation topic. If you have a more general question about Splunk functionality or are experiencing a difficulty with Splunk, consider posting a question to Splunkbase Answers.

0 out of 1000 Characters