Getting Data In

Sourcetype renaming not taking

srich
Explorer

Following the documentation for sourcetype renaming, I still fail to get it working. I have added an entry in Sourcetype renaming and have created a props.conf file in the etc/system/local directory. I have restarted Splunkd and still zip. I'm running the latest version of Splunk. Help!

props.conf:
[Printer]
rename=System-III

[Printer2]
rename=System-III

[Printer3]
rename=System-III

[Printer-too_small]
rename=System-III

Tags (2)
0 Karma

pgoyal_splunk
Splunk Employee
Splunk Employee

If you have Splunk Enterprise, you can use the rename attribute in props.conf to assign events to a new source type at search time. In case you ever need to search on it, the original source type is moved to a separate field, _sourcetype.
Do the changes on the search Head.

You can also refer to the below link to rename the sourcetype at search time.

https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Renamesourcetypes

0 Karma

ewoo
Splunk Employee
Splunk Employee

Sourcetype renaming is a search-time operation. The props.conf with the renamed sourcetype should be placed on your search head. You should be able to observe the renamed sourcetype taking effect immediately by running a search; you do not need to index any new data.

0 Karma

gnovak
Builder

After i thought this worked, it actually didn't. I have props.conf on all of my main indexers and still i am not seeing the sourcetype renamed. it's still showing up as the old one.

0 Karma

gnovak
Builder

Actually one thing i just found out. I put the props.conf on the indexer and it appears to be working. At first I put it on the lightweight forwarder.

0 Karma

gnovak
Builder

I am also seeing the same thing. I have put a props.conf file in /etc/system/local directory and it looks almost identical in the format of the one post by srich. After about an hour I still am not seeing all my sourcetypes renamed. How long does this take?

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...