Getting Data In

How to edit my configurations to rename the sourcetype name as the index name?

vchigurupati
New Member

Hi guys,

1) Index name=A1 sourcetype =B & 2) indexname=A2 sourcetype = B now my task is to rename the sourcetype name as index name for both of them. So, can someone please help me with stanza script that I have to write in props.conf and transforms.conf including with the regular expression? We have 100+ indexes to rename like this. After getting the answer, I will learn and will follow for other index as same.

0 Karma

woodcock
Esteemed Legend

Generally both index and sourcetype are set inside of inputs.conf so start there on your Idexers and restart splunk there when updated. That will make the data moving forward be different. As far as the data already indexed, you should use rename sourcetype in props.conf on your Search Heads:

https://docs.splunk.com/Documentation/SplunkCloud/6.5.1612/Data/Renamesourcetypes

0 Karma

vchigurupati
New Member

thank you so much, can you please help me on give regex for source /var/log/*/access in such a way that it should extract the source field

0 Karma

woodcock
Esteemed Legend

I am very unclear on your goal. I assume that this is true:

You have events coming like this:

DATASET 1: index=A1 sourcetype=B
DATASET 2: index=A2 sourcetype=B
Now I am somewhat guessing. Are you saying that you need to change configurations so that:

DATASET 1: index=B sourcetype=B
DATASET 2: index=B sourcetype=B
The above seems silly because now you cannot easily discriminate between the 2 datasets so perhaps you are saying that you need to change configurations so that:

DATASET 1: index=A1 sourcetype=A1
DATASET 2: index=A2 sourcetype=A2
But again, this seems counter-productive and silly; it is a net loss of discrimination.

So I am assuming that your desire is something else entirely so please do explain. If one of these is what you are asking, then my push-back to you is: WHY? I am sure that whatever you are trying to accomplish can be done without de-discriminating your data.

0 Karma

vchigurupati
New Member

I do have two indexes A1 and A2 with the same source type name B, now i want to combine both the indexes into one and change the source type for the data from old index(A1) to different name(B1) and same for the data from old index(A2) to different name (B2).So here the scenario looks like:
(Old)
DATASET 1: index=A1 sourcetype=B
DATASET 2: index=A2 sourcetype=B

(New)
DATASET: index=A(data from A1 and A2) sourcetype=B1(for data from old indexA1), B2(for data from old indexA2)

Is there a solution for this as it's already indexed data.

0 Karma

adonio
Ultra Champion
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...