https://community.splunk.com/t5/Getting-Data-In/How-to-assign-all-sources-the-same-sourcetype/m-p/97331#M20295 <P>yes source will work even with regex like this:</P> <PRE><CODE>[source::....(?&lt;!tar.)(gz|tgz)] sourcetype=a_sourcetype </CODE></PRE> Wed, 21 Mar 2012 20:38:54 GMT MarioM 2012-03-21T20:38:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-assign-all-sources-the-same-sourcetype/m-p/97330#M20294 <P>I want to assign ALL sources the sourcetype my_logs_555, and then use the Priority parameter in props.conf to apply a different sourcetype to a few sources here and there.</P> <P>What would the stanza be to assign all sources to the sourcetype my_logs_555?</P> <P>Something like this?<BR /> [source::...]<BR /> sourcetype = my_logs_555</P> <P>Would this stanza also work for UNC paths?</P> Mon, 28 Sep 2020 11:32:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-assign-all-sources-the-same-sourcetype/m-p/97330#M20294 sgarvin55 2020-09-28T11:32:54Z https://community.splunk.com/t5/Getting-Data-In/How-to-assign-all-sources-the-same-sourcetype/m-p/97331#M20295 <P>yes source will work even with regex like this:</P> <PRE><CODE>[source::....(?&lt;!tar.)(gz|tgz)] sourcetype=a_sourcetype </CODE></PRE> Wed, 21 Mar 2012 20:38:54 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-assign-all-sources-the-same-sourcetype/m-p/97331#M20295 MarioM 2012-03-21T20:38:54Z