We're building an app for WebSphere. We're prefixing all the app's sourcetypes with "WebSphere:" to disambiguate them from other apps' sourcetypes.
Now we need to decide about lowercase or PascalCase for our sourcetype prefix.
Is it preferable to do "websphere:somesourcetype" or "WebSphere:somesourcetype"?
For anything we have defined (other than windows logs) it has been lower case i.e. "sep:ids". Windows we went with PascalCase to conform with the default Splunk sourcetype of "WinEventLog". So for windows logs we have eventtypes of "Snare:Security" and "Monitorware:Security"