https://community.splunk.com/t5/Getting-Data-In/Is-there-a-Splunk-Segment-setting-for-sourcetype-similar-to-host/m-p/273066#M52432 <P>No, this doesnt exists. You could set a sourcetype based on the source of the file in transforms.conf, upstream at indextime or HF layer.</P> Thu, 15 Oct 2015 07:24:18 GMT esix_splunk 2015-10-15T07:24:18Z https://community.splunk.com/t5/Getting-Data-In/Is-there-a-Splunk-Segment-setting-for-sourcetype-similar-to-host/m-p/273065#M52431 <P>Splunk 6.3</P> <P>I am looking at the feature host_segment=x in inputs.conf. And wondering if there is a similar feature for source type? </P> <P>For example, I have a directory of logs on the network for a series of servers that look like this</P> <P>/NFS/mounts/Servername/sourcetype/thefiles.txt</P> <P>I'd like to just set this, but that doesn't seem to work. Any trick to this? Or work around? </P> <PRE><CODE>[monitor:////nfs/mounts/*/*/*] host_segment=3 sourcetype_segment=4 disable=0 </CODE></PRE> Thu, 15 Oct 2015 06:29:11 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-a-Splunk-Segment-setting-for-sourcetype-similar-to-host/m-p/273065#M52431 daniel333 2015-10-15T06:29:11Z https://community.splunk.com/t5/Getting-Data-In/Is-there-a-Splunk-Segment-setting-for-sourcetype-similar-to-host/m-p/273066#M52432 <P>No, this doesnt exists. You could set a sourcetype based on the source of the file in transforms.conf, upstream at indextime or HF layer.</P> Thu, 15 Oct 2015 07:24:18 GMT https://community.splunk.com/t5/Getting-Data-In/Is-there-a-Splunk-Segment-setting-for-sourcetype-similar-to-host/m-p/273066#M52432 esix_splunk 2015-10-15T07:24:18Z