No, you cannot have wildcarded sourcetype configurations. As @woodcock mentioned, there is a hack, a really messy hack. It is undocumented for many reasons.
You should not use it for these reasons:
- This feature is not a feature
- It is not supported
- It is not QA'ed
- It is not guaranteed to exist in next release
- Performance impacts at scale
- Adds complexity to troubleshooting and future development
Here is the blog post where this stems from http://blogs.splunk.com/2014/07/31/quick-tip-wildcard-sourcetypes-in-props-conf/
Additionally - @jrodman says not to use it, and he would know.
