I'm checking out http://docs.splunk.com/Documentation/Splunk/6.0.2/Data/MonitorWindowshostinformation features instead of using my own version.
It looks like the sourcetype cannot be changed on these. Is that accurate? The only option is to use a sourcetype rename? Something like this will not be honored:
[WinHostMon://application]
type = application
interval = 60
sourcetype = software_inventory_win
I'm guessing I'm missing something here. Anyone have any tips?
That is correct, you can't set a new sourcetype for certain input types.
That is correct, you can't set a new sourcetype for certain input types.
This is something that is determined by the input's author. It is in fact possible (as suggested above) to change the sourcetype via a TRANSFORM rule in props.conf. It is also possible for the author of the input to set the sourcetype. This is typically not done, because the inputs are usually paired with a set of rules (field extractions, tags, etc) that operate against a particular sourcetype, as well as searches and dashboards. Since the purpose of a sourcetype is to specify the type of data, and any one input knows its own, it rarely makes sense to allow changes to it.
Thanks for the clear answer. Is this a limitation of the Windows App or splunk enterprise?
props.conf at indexer to change it...
Looks like sourcetype renaming is the only option for specific data inputs like scripted input , Windows Event monitoring and this one.