When i execute a schedule report (summary index) on Splunk, the sourcetype name will be default as "stash".
How can i change the sourcetype name from "stash" to my own specific name?
Here is my search string:
index=idx_wls_access_log_raw splunk_server=local | eval uri_type=case(cs_uri_stem=="/lbHealthMon/index.jsp", "lbhealthmon", 1=1, "application") | bucket _time span=15m | stats count(cs_uri_stem) as "count", sum(time_taken) as "processing_time_total", avg(time_taken) as "processing_time_avg", max(time_taken) as "processing_time_max", exactperc99.99(time_taken) as "processing_time_99.99%-tile" ................... count(eval(sc_status>=400 AND sc_status<=499)) as "response_code_4xx", count(eval(sc_status>=500 AND sc_status<=599)) as "response_code_5xx" by _time uri_type managed_server domain | eval starttime = _time | eval endtime = _time + 900 | eval _time = now()
Thanks
Best regards
... View more