https://community.splunk.com/t5/Getting-Data-In/Renaming-multiple-sourcetype/m-p/31543#M5548 <P>How can i rename more than one soucrtypes?</P> <P>I have iis-2 iis-3 ...</P> <P>Can this work?<BR /> [iis*]<BR /> rename=iis</P> Thu, 14 Feb 2013 00:52:48 GMT pdash 2013-02-14T00:52:48Z https://community.splunk.com/t5/Getting-Data-In/Renaming-multiple-sourcetype/m-p/31543#M5548 <P>How can i rename more than one soucrtypes?</P> <P>I have iis-2 iis-3 ...</P> <P>Can this work?<BR /> [iis*]<BR /> rename=iis</P> Thu, 14 Feb 2013 00:52:48 GMT https://community.splunk.com/t5/Getting-Data-In/Renaming-multiple-sourcetype/m-p/31543#M5548 pdash 2013-02-14T00:52:48Z https://community.splunk.com/t5/Getting-Data-In/Renaming-multiple-sourcetype/m-p/31544#M5549 <P>See <A href="http://splunk-base.splunk.com/answers/8505/is-it-possible-to-use-wildcards-in-sourcetype-propsconf-stanzas">this</A> on how to use wildcards in sourcetype stanzas.</P> <P>Read the 2nd answer for a disclaimer</P> <P>From there you should be able to do :</P> <PRE><CODE>[(?:::){0}iis*] sourcetype=iis </CODE></PRE> Thu, 14 Feb 2013 01:51:00 GMT https://community.splunk.com/t5/Getting-Data-In/Renaming-multiple-sourcetype/m-p/31544#M5549 jonuwz 2013-02-14T01:51:00Z