Getting Data In

How to edit my configurations to rename the sourcetype name as the index name?

vchigurupati
New Member

Hi guys,

1) Index name=A1 sourcetype =B & 2) indexname=A2 sourcetype = B now my task is to rename the sourcetype name as index name for both of them. So, can someone please help me with stanza script that I have to write in props.conf and transforms.conf including with the regular expression? We have 100+ indexes to rename like this. After getting the answer, I will learn and will follow for other index as same.

0 Karma

woodcock
Esteemed Legend

Generally both index and sourcetype are set inside of inputs.conf so start there on your Idexers and restart splunk there when updated. That will make the data moving forward be different. As far as the data already indexed, you should use rename sourcetype in props.conf on your Search Heads:

https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Renamesourcetypes

0 Karma

vchigurupati
New Member

thank you so much, can you please help me on give regex for source /var/log/*/access in such a way that it should extract the source field

0 Karma

woodcock
Esteemed Legend

I am very unclear on your goal. I assume that this is true:

You have events coming like this:

DATASET 1: index=A1 sourcetype=B
DATASET 2: index=A2 sourcetype=B
Now I am somewhat guessing. Are you saying that you need to change configurations so that:

DATASET 1: index=B sourcetype=B
DATASET 2: index=B sourcetype=B
The above seems silly because now you cannot easily discriminate between the 2 datasets so perhaps you are saying that you need to change configurations so that:

DATASET 1: index=A1 sourcetype=A1
DATASET 2: index=A2 sourcetype=A2
But again, this seems counter-productive and silly; it is a net loss of discrimination.

So I am assuming that your desire is something else entirely so please do explain. If one of these is what you are asking, then my push-back to you is: WHY? I am sure that whatever you are trying to accomplish can be done without de-discriminating your data.

0 Karma

vchigurupati
New Member

I do have two indexes A1 and A2 with the same source type name B, now i want to combine both the indexes into one and change the source type for the data from old index(A1) to different name(B1) and same for the data from old index(A2) to different name (B2).So here the scenario looks like:
(Old)
DATASET 1: index=A1 sourcetype=B
DATASET 2: index=A2 sourcetype=B

(New)
DATASET: index=A(data from A1 and A2) sourcetype=B1(for data from old indexA1), B2(for data from old indexA2)

Is there a solution for this as it's already indexed data.

0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...