Rename source types at search time
You might want to rename a source type in certain situations. For example, say you accidentally assigned an input to the wrong source type. Or you realize that two differently named source types should be handled exactly the same at search time.
If you have Splunk Enterprise, you can use the
rename attribute in
props.conf to assign events to a new source type at search time. In case you ever need to search on it, the original source type is moved to a separate field,
Note: The indexed events still contain the original source type name. The renaming occurs only at search time. Also, renaming the source type does only that; it does not fix any problems with the indexed format of your event data caused by assigning the wrong source type in the first place.
To rename the source type, add the
rename attribute to your source type stanza:
rename = <string>
Note: A source type name can only contain the letters
z, the numerals
: character, and the
_ (underscore) character.
For example, say you're using the source type "cheese_shop" for your application server. Then, accidentally, you index a pile of data as source type "whoops". You can rename "whoops" to "cheese_shop" with this
Now, a search on "cheese_shop" will bring up all the "whoops" events as well as any events that had a "cheese_shop" source type from the start:
If you ever need to single out the "whoops" events, you can use
_sourcetype in your search:
Important: Data from a renamed source type will only use the search-time configuration for the target source type ("cheese_shop" in this example). Any field extractions for the original source type ("whoops" in the example) will be ignored.
Manage source types
About event segmentation
This documentation applies to the following versions of Splunk Cloud™: 7.0.8, 7.0.11, 7.0.13