Capture data from single index and differentiate logs based on sourcetype

[splunklearner]

We have big application which contains small applications data coming onto Splunk. Currently we are mapping FQDNs to indexname for other application. But this big application wants single index for all their FQDNs but they want to differentiate their application data based on sourcetype.

As of now we have only one sourcetype which receives data from all other applications.

Example: there is Fruits application and there is apple, orange, and pineapple applications in it. They want single index for Fruits application and they want to differentiate by using sourcetype=apple and sourcetype=orange and soon....

For remaining applications we are simply mapping FQDN to indexname in transforms.conf by using lookups and ingestEval. I can map all fruits application FQDNs to single index then all logs will be mixed right (apple,orange and soon....)... How can we differentiate with by using sourcetype? Where and how I need to write the logic? 

[isoutamo]

I’m not sure if I fully understood your issue.

Anyhow sourcetype’s purpose is separate different log formats. If all those apps have exactly same lexical content of logs then they could/should have same sourcetype. But if the e.g. apple and orange creates logs which have different fields etc. then those should have different sourcetypes assigned for those logs.

When you have two different apps and those have exactly same log format but you want separate those you could named those like sourcetype=“apple:module:log:1” and sourcetype=“orange:module:log1” or what ever names you want to use. Then just define those equally in props.conf.