Hi @lhanich1,
you, can add all the input stanzas you want, there's only the limitation that via GUI you cannot use the same port for more stanzas, but you can do it by conf file.
You can configure different ways to differentiate logs:
- different ports to have different sourcetypes for each class of appliances,
- only one port and one sourcetype with override of the sourcetype based on syslog content,
- a mix of them.
The important thing is to recognize sourcetype to correctly configure knowledge objects (fields, tags, etc...)
Only one Hint (if possible) if you have a distributed architecture (more Indexers, more Search Heads, etc...), in other words, if you haven't an All-In-One server, don' use Indexer to ingest syslogs, because during Indexers maintenance, you lose your syslogs.
The better architecture to ingest syslogs is to have two Heavy Forwarders (Full Splunk Enterprise instances that forward all the logs to Indexers) and a Load Balancer that manage load balancing and fail over (if you haven't a Load balancer, you can also use DNS for this): in this way you're sure to ingest syslogs also during Indexers maintenance or fail over.
Ciao.
Giuseppe
