https://community.splunk.com/t5/Splunk-Search/Multiple-sourcetypes-per-source/m-p/95843#M24734 <P>Hi,<BR /> I have a novice question, but is it possible to have more than one sourcetype for a given source?</P> Fri, 21 Oct 2011 00:12:30 GMT Samslara 2011-10-21T00:12:30Z https://community.splunk.com/t5/Splunk-Search/Multiple-sourcetypes-per-source/m-p/95843#M24734 <P>Hi,<BR /> I have a novice question, but is it possible to have more than one sourcetype for a given source?</P> Fri, 21 Oct 2011 00:12:30 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-sourcetypes-per-source/m-p/95843#M24734 Samslara 2011-10-21T00:12:30Z https://community.splunk.com/t5/Splunk-Search/Multiple-sourcetypes-per-source/m-p/95844#M24735 <P>Sure.</P> <PRE><CODE>In props.conf [source::&lt;your source name&gt;] TRANSFORMS-XXX = AAA TRANSFORMS-YYY = BBB ... In transforms.conf [AAA] REGEX = &lt;Extract a trait in your log like host IP or something else&gt; DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::&lt;your sourcetype name&gt; [BBB] ... </CODE></PRE> Fri, 21 Oct 2011 02:21:07 GMT https://community.splunk.com/t5/Splunk-Search/Multiple-sourcetypes-per-source/m-p/95844#M24735 hjwang 2011-10-21T02:21:07Z