https://community.splunk.com/t5/Getting-Data-In/Same-data-input-two-apps/m-p/513169#M87022 <P>Is it possible to share a sourcetype'd data between two apps?</P><P>I have pfsense sending both firewall logs and Suricata eve json logs to the same UDP data input.&nbsp; The TA-pfsense app is sourcetyping, field extracting and indexing the various syslog types from pfsense.&nbsp; The TA-Suricata has the props.conf, lookups, eventtypes etc to extract relevant data from the eve json logs mixed into this UDP data stream.&nbsp;</P><P>Is there a way to send the sourcetype:suricata from the TA-pfsense props to point to the TA-Suricata inputs.conf?</P> Sat, 08 Aug 2020 20:45:20 GMT token2 2020-08-08T20:45:20Z https://community.splunk.com/t5/Getting-Data-In/Same-data-input-two-apps/m-p/513169#M87022 <P>Is it possible to share a sourcetype'd data between two apps?</P><P>I have pfsense sending both firewall logs and Suricata eve json logs to the same UDP data input.&nbsp; The TA-pfsense app is sourcetyping, field extracting and indexing the various syslog types from pfsense.&nbsp; The TA-Suricata has the props.conf, lookups, eventtypes etc to extract relevant data from the eve json logs mixed into this UDP data stream.&nbsp;</P><P>Is there a way to send the sourcetype:suricata from the TA-pfsense props to point to the TA-Suricata inputs.conf?</P> Sat, 08 Aug 2020 20:45:20 GMT https://community.splunk.com/t5/Getting-Data-In/Same-data-input-two-apps/m-p/513169#M87022 token2 2020-08-08T20:45:20Z https://community.splunk.com/t5/Getting-Data-In/Same-data-input-two-apps/m-p/513174#M87024 <P>One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.&nbsp; I recommend you do everything in your power to have the two sources arrive at two different ports.</P><P>If that is not possible then all is not necessarily lost.&nbsp; I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.&nbsp; You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.&nbsp; Then Splunk's universal forwarder can read each file and know each source type from the file location.</P> Sat, 08 Aug 2020 23:51:37 GMT https://community.splunk.com/t5/Getting-Data-In/Same-data-input-two-apps/m-p/513174#M87024 richgalloway 2020-08-08T23:51:37Z