How to override sourcetype AND index assignment?

[jamesvz84]

The following docs should how to override sourcetype: http://docs.splunk.com/Documentation/Splunk/6.2.5/Data/Advancedsourcetypeoverrides

A similar method is used to override index.

My question is, how do I override sourcetype AND index at parsing time?

[somesoni2 · Accepted solution]

See this

https://answers.splunk.com/answers/246672/how-can-i-override-an-index-name-based-on-sourcety.html
and

http://answers.splunk.com/answers/1026/route-data-to-index-based-on-host.html