https://community.splunk.com/t5/Getting-Data-In/How-to-override-sourcetype-AND-index-assignment/m-p/186499#M37356 <P>See this</P> <P><A href="https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html">https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html</A><BR /> and</P> <P><A href="http://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html">http://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html</A></P> Wed, 26 Aug 2015 17:14:32 GMT somesoni2 2015-08-26T17:14:32Z https://community.splunk.com/t5/Getting-Data-In/How-to-override-sourcetype-AND-index-assignment/m-p/186498#M37355 <P>The following docs should how to override sourcetype: <A href="http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Advancedsourcetypeoverrides</A></P> <P>A similar method is used to override index.</P> <P>My question is, how do I override sourcetype AND index at parsing time?</P> Wed, 26 Aug 2015 16:30:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-sourcetype-AND-index-assignment/m-p/186498#M37355 jamesvz84 2015-08-26T16:30:34Z https://community.splunk.com/t5/Getting-Data-In/How-to-override-sourcetype-AND-index-assignment/m-p/186499#M37356 <P>See this</P> <P><A href="https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html">https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html</A><BR /> and</P> <P><A href="http://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html">http://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html</A></P> Wed, 26 Aug 2015 17:14:32 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-override-sourcetype-AND-index-assignment/m-p/186499#M37356 somesoni2 2015-08-26T17:14:32Z