https://community.splunk.com/t5/Getting-Data-In/More-than-one-DEST-KEY/m-p/60945#M12110 <P>This really should be two separate transforms.</P> <P>Take a look at this thread:<BR /> <A href="http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention/6634#6634" rel="nofollow">http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention/6634#6634</A></P> Thu, 30 Sep 2010 06:57:48 GMT southeringtonp 2010-09-30T06:57:48Z https://community.splunk.com/t5/Getting-Data-In/More-than-one-DEST-KEY/m-p/60944#M12109 <P>Can I use more than one DEST_KEY? For example </P> <P>DEST_KEY=_MetaData:Index,MetaData:Sourcetype<BR /> FORMAT=sourcetype::VPN,index::authent</P> <P>I currently have some VPN logs coming in through syslog that I would like to route to an index, and rename the sourcetype. </P> Thu, 30 Sep 2010 06:45:10 GMT https://community.splunk.com/t5/Getting-Data-In/More-than-one-DEST-KEY/m-p/60944#M12109 carmackd 2010-09-30T06:45:10Z https://community.splunk.com/t5/Getting-Data-In/More-than-one-DEST-KEY/m-p/60945#M12110 <P>This really should be two separate transforms.</P> <P>Take a look at this thread:<BR /> <A href="http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention/6634#6634" rel="nofollow">http://answers.splunk.com/questions/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-naming-convention/6634#6634</A></P> Thu, 30 Sep 2010 06:57:48 GMT https://community.splunk.com/t5/Getting-Data-In/More-than-one-DEST-KEY/m-p/60945#M12110 southeringtonp 2010-09-30T06:57:48Z