https://community.splunk.com/t5/Getting-Data-In/Multiple-sources-in-event/m-p/489687#M83715 <P>Hi.</P> <P>We are ingesting log from a HEC input where in the stanza we are setting a source.<BR /> In the events there is a field called Source that is extracted into an other source (in search time)</P> <P>Meaning all events having 2 source with different names.<BR /> Any suggestion on how to solve this issue?</P> Wed, 25 Sep 2019 07:02:07 GMT broberg 2019-09-25T07:02:07Z https://community.splunk.com/t5/Getting-Data-In/Multiple-sources-in-event/m-p/489687#M83715 <P>Hi.</P> <P>We are ingesting log from a HEC input where in the stanza we are setting a source.<BR /> In the events there is a field called Source that is extracted into an other source (in search time)</P> <P>Meaning all events having 2 source with different names.<BR /> Any suggestion on how to solve this issue?</P> Wed, 25 Sep 2019 07:02:07 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-sources-in-event/m-p/489687#M83715 broberg 2019-09-25T07:02:07Z