https://community.splunk.com/t5/Getting-Data-In/Creating-aggregate-sourcetypes-possible/m-p/142651#M29166 <P>Depending on your sourcetypes this might take you a step closer: <A href="http://blogs.splunk.com/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf/">http://blogs.splunk.com/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf/</A></P> <P>Considering that's evaluating a regex you should be able to list your four sample sourcetypes separated by pipes as OR and be done.</P> Sat, 27 Sep 2014 00:06:10 GMT martin_mueller 2014-09-27T00:06:10Z https://community.splunk.com/t5/Getting-Data-In/Creating-aggregate-sourcetypes-possible/m-p/142650#M29165 <P>Total noob here. I want to create a source type that is an aggregate of several source types. What I want to eventually end up with is the ability to easily apply several REPORT rules to a set of source types. Below is a mockup of roughly what I want functionality-wise in my props.conf:</P> <PRE><CODE>[sourcetype1 sourcetype2 sourcetype3 sourcetype4] REPORT-AAAAA = AAAAA REPORT-BBBBB = BBBBB REPORT-CCCCC = CCCCC REPORT-DDDDD = DDDDD </CODE></PRE> <P>Is something along these lines possible to do in Splunk? Thanks for any help</P> Fri, 26 Sep 2014 20:03:38 GMT https://community.splunk.com/t5/Getting-Data-In/Creating-aggregate-sourcetypes-possible/m-p/142650#M29165 snaz 2014-09-26T20:03:38Z https://community.splunk.com/t5/Getting-Data-In/Creating-aggregate-sourcetypes-possible/m-p/142651#M29166 <P>Depending on your sourcetypes this might take you a step closer: <A href="http://blogs.splunk.com/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf/">http://blogs.splunk.com/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf/</A></P> <P>Considering that's evaluating a regex you should be able to list your four sample sourcetypes separated by pipes as OR and be done.</P> Sat, 27 Sep 2014 00:06:10 GMT https://community.splunk.com/t5/Getting-Data-In/Creating-aggregate-sourcetypes-possible/m-p/142651#M29166 martin_mueller 2014-09-27T00:06:10Z