I want to assign ALL sources the sourcetype my_logs_555, and then use the Priority parameter in props.conf to apply a different sourcetype to a few sources here and there.
What would the stanza be to assign all sources to the sourcetype my_logs_555?
Something like this?
[source::...]
sourcetype = my_logs_555
Would this stanza also work for UNC paths?
yes source will work even with regex like this:
[source::....(?<!tar.)(gz|tgz)]
sourcetype=a_sourcetype