Our Splunk server receives data through syslog, and all data is tagged with 'sourcetype=syslog'.
I am interested in using the Splunk App for Web Intelligence to parse data from several dozen different Apache webservers. My weblogs are sent to Splunk, but they are sent via syslog and thus Splunk automatically assigns the 'syslog' sourcetype to this data. The Splunk App for Web Intelligence doesn't work with 'sourcetype=syslog'. I need to assign a new kind of sourcetype to this data.
Can data belong to multiple kinds of sourcetypes? If I define the Sourcetype like 'access_combined' for my Apache HTTP logs, will it still belong to the 'syslog' Sourcetype?
Data may only have a single sourcetype. However, if you define a new sourcetype, you can set it to perform multiple transforms and field extractions that would apply to, say, both syslog and to access_combined, but looking at and duplicating the configurations of each in props.conf.