Rename source types at search time

You might encounter situations where you want to rename a source type. For example, say you accidentally assigned an input to the wrong source type. Or you realize that two differently named source types actually need to be handled the same way at search time.

If you use Splunk Enterprise, you can add the rename setting in the props.conf configuration file to assign events to a new source type at search time. If you need to search on it, Splunk Enterprise moves the original source type to a separate field, called _sourcetype.

On Splunk Cloud Platform, you must open a support ticket to rename source types, as the props.conf file is not available for editing on a Splunk Cloud Platform instance and using a heavy forwarder is not possible as renaming source types is only applicable on data that you have already indexed.

The indexed events still contain the original source type name. The renaming of source types occurs only at search time. Also, renaming the source type does only that. It doesn't fix problems with the indexed format of your event data that were caused by assigning the wrong source type in the first place.

To rename the source type, add the rename setting to your source type stanza in the props.conf file:

rename = <string>

Source type names do not support the following characters: <, >, ?, #, and &

For example, say you're using the source type cheese_shop for your application server. Then you accidentally index a bunch of data as source type whoops. You can rename whoops to cheese_shop with the following stanza in the props.conf file:

[whoops]
rename=cheese_shop

Now, a search on cheese_shop returns all the whoops events as well as any events that had the cheese_shop source type:

sourcetype=cheese_shop

If you ever need to single out the whoops events, you can use _sourcetype in your search:

_sourcetype=whoops

Data from a renamed source type uses only the search-time configuration for the target source type, in this example it is cheese_shop. The Splunk platform ignores any field extractions for the original source type.