https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218144#M42899 <P>Answered, but I wanted to suggest that you consider sending your syslog traffic to a syslog-ng server, do your filtering/tagging there and write to separate files that are then processed by a UF.<BR /> Sending syslog traffic directly to your indexer will mean you will lose events whenever you have to restart your indexer.</P> Sat, 09 Jan 2016 05:49:22 GMT s2_splunk 2016-01-09T05:49:22Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218142#M42897 <P>How do I select different sourcetypes for multiple logs coming from multiple servers (no universal forwarders, using rsyslog.conf)? When I set up the input port, it only offers one type of sourcetype choice.</P> Fri, 08 Jan 2016 18:16:34 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218142#M42897 CREVITCH 2016-01-08T18:16:34Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218143#M42898 <P>This is needs to be done </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Advancedsourcetypeoverrides</A></P> Fri, 08 Jan 2016 18:42:26 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218143#M42898 somesoni2 2016-01-08T18:42:26Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218144#M42899 <P>Answered, but I wanted to suggest that you consider sending your syslog traffic to a syslog-ng server, do your filtering/tagging there and write to separate files that are then processed by a UF.<BR /> Sending syslog traffic directly to your indexer will mean you will lose events whenever you have to restart your indexer.</P> Sat, 09 Jan 2016 05:49:22 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218144#M42899 s2_splunk 2016-01-09T05:49:22Z https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218145#M42900 <P>Or you can follow this RSysLog 8.15.0 guide I wrote specifically for Splunk usage.<BR /> <A href="https://answers.splunk.com/answers/337489/howto-setup-rsyslog-network-event-log-filtering-ba.html">https://answers.splunk.com/answers/337489/howto-setup-rsyslog-network-event-log-filtering-ba.html</A></P> Mon, 11 Jan 2016 04:22:18 GMT https://community.splunk.com/t5/Getting-Data-In/How-do-I-select-different-sourcetypes-for-multiple-logs-coming/m-p/218145#M42900 milesbrennan 2016-01-11T04:22:18Z