Alias a source type

Alias source types to make searching and filtering easier in Splunk Web. Source type aliases are just like tags except you can only apply a single alias to one (or more) source types, and not more than one alias to a single source type. Source type aliases are useful for:

Reducing the number of source types that appear on the main dashboard by renaming many source types as an alias.
Renaming a source type value to something more simple or meaningful to you.

When you alias a source type, Splunk doesn't change the value of the source type it stores in the index (in props.conf). Splunk only changes the source type value it displays in Splunk Web. You can still use the indexed source type value in searches (If you set indexing properties for a source type in props.conf, you must use the source type value that's in sourcetypes.conf).

Splunk puts configuration information for source type aliases in tags.conf. Configure a source type alias via configuration files by editing tags.conf (just like you configure tags).

Source type vs. source type alias

Splunk applies a source type value to events from a source at index time. Use the source type value that Splunk indexes at search time to set custom indexing properties or extracted field rules. You can either configure how Splunk applies source types to events, or you can let Splunk automatically apply a source type based on rules. Learn how Splunk applies sourcetype field values to events. Configure source types manually by editing indexes.conf, props.conf, and configure automatic source type settings by editing sourcetypes.conf.

A source type alias is an alias that you apply to a source type at search time. Create an alias to a source type via Splunk Web (link to how to), or by editing the stanza for the source that's in props.conf. When you add a source type alias, Splunk adds a line in tags.conf.

Add/edit a source type alias

Add or edit a source type alias via Splunk Web. You can also edit a source type alias via tags.conf.

Note: Make sure the sourcetype field is present in the Fields menu above your search results. If not, add the sourcetype field by selecting it in the Fields picker.

1. Click on the drop-down arrow next to the sourcetype field of any event.
2. Select Edit sourcetype alias.
3. Enter an alias for the source type in the dialog box that pops up.

Previous: Manage tags with tagcreate and tagdelete | Next: Run reports

Comments

No comments have been submitted.