Rename source types at search time
You might encounter situations where you want to rename a source type. For example, say you accidentally assigned an input to the wrong source type. Or you realize that two differently named source types actually need to be handled the same way at search time.
If you use Splunk Enterprise, you can add the
rename setting in the props.conf configuration file to assign events to a new source type at search time. If you need to search on it, Splunk Enterprise moves the original source type to a separate field, called
On Splunk Cloud Platform, you must open a support ticket to rename source types, as the props.conf file is not available for editing on a Splunk Cloud Platform instance and using a heavy forwarder is not possible as renaming source types is only applicable on data that you have already indexed.
The indexed events still contain the original source type name. The renaming of source types occurs only at search time. Also, renaming the source type does only that. It doesn't fix problems with the indexed format of your event data that were caused by assigning the wrong source type in the first place.
To rename the source type, add the
rename setting to your source type stanza in the props.conf file:
rename = <string>
Source type names do not support the following characters:
For example, say you're using the source type
cheese_shop for your application server. Then you accidentally index a bunch of data as source type
whoops. You can rename
cheese_shop with the following stanza in the props.conf file:
Now, a search on
cheese_shop returns all the
whoops events as well as any events that had the
cheese_shop source type:
If you ever need to single out the
whoops events, you can use
_sourcetype in your search:
Data from a renamed source type uses only the search-time configuration for the target source type, in this example it is
cheese_shop. The Splunk platform ignores any field extractions for the original source type.
Manage source types
About event segmentation
This documentation applies to the following versions of Splunk Cloud Platform™: 8.2.2112, 8.2.2201, 8.2.2202, 8.2.2203, 9.0.2205, 9.0.2208, 9.0.2209 (latest FedRAMP release), 9.0.2303
Feedback submitted, thanks!