https://community.splunk.com/t5/Getting-Data-In/Routing-syslog-streams-to-different-index/m-p/32217#M5715 <P>Don't specify the server and you'll get the data from both. [udp://518]</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_using_inputs.conf">http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_using_inputs.conf</A></P> <P>If <REMOTE server=""> is empty - [udp://port] - the port will accept data sent from any server.</REMOTE></P> <P>Then here to specify the sourcetype etc... </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides</A></P> Fri, 20 Apr 2012 18:26:00 GMT sdaniels 2012-04-20T18:26:00Z https://community.splunk.com/t5/Getting-Data-In/Routing-syslog-streams-to-different-index/m-p/32216#M5714 <P>I have a stream (udp 518) of syslog coming in from two different syslog servers. I thought that I would be able to specify in inputs.conf like so:</P> <P>[udp://server1:518]<BR /> sourcetype = syslog<BR /> index = index1<BR /> connection_host = dns </P> <P>[udp://server2:518]<BR /> sourcetype = syslog<BR /> index = index2<BR /> connection_host = dns </P> <P>This is not working. If i comment out the second stanza, i can see syslog from server1 in index1, but nothing if both are uncommented. Any thoughts?</P> Fri, 20 Apr 2012 15:27:53 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-syslog-streams-to-different-index/m-p/32216#M5714 menkurau 2012-04-20T15:27:53Z https://community.splunk.com/t5/Getting-Data-In/Routing-syslog-streams-to-different-index/m-p/32217#M5715 <P>Don't specify the server and you'll get the data from both. [udp://518]</P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_using_inputs.conf">http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_using_inputs.conf</A></P> <P>If <REMOTE server=""> is empty - [udp://port] - the port will accept data sent from any server.</REMOTE></P> <P>Then here to specify the sourcetype etc... </P> <P><A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides">http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides</A></P> Fri, 20 Apr 2012 18:26:00 GMT https://community.splunk.com/t5/Getting-Data-In/Routing-syslog-streams-to-different-index/m-p/32217#M5715 sdaniels 2012-04-20T18:26:00Z