topic Re: Using different stanza defined in props.conf with same index in Getting Data In

Using different stanza defined in props.conf with same index

yuwtennis — Mon, 04 Nov 2013 09:37:09 GMT

Hi!

I would like to ask question if something like below is possible.

I already have a

index A with sourcetype A (sourcetype A defined in props.conf)

However, I want to use the same indexA with different purpose
and want to define sourcetype B in props.conf.

So ,

in search A , I want to use index A with sourcetype A

but in search B , I want to use index A with sourcetype B.

Is this possible?

Thnaks,
Yu

gfuente — Mon, 04 Nov 2013 09:48:45 GMT

Hello,

Of course it is. You only need to define the same index in your inputs. Like:

[sourcetypeA]
 index = A

[sourcetypeB]
 index = A

And then in your query filter as you need:

index= A sourcetype=sourcetypeB

Regards

yuwtennis — Mon, 25 Nov 2013 10:49:11 GMT

Hi gfuente.

I just want to confirm that is this to be defined in props.conf?