Is it possible to do a sequential double override of index and sourcetype coming from 1 source?

[Log_wrangler]

Previous related question:
What adverse results can occur if using an override index and override sourcetype at the same time?

I have been unable to get a double override to work. At this point just wanted to see if anyone else has done this or if its impossible.

Thank you

[mdsnmss]

How are you setting the sourcetype and index now? How is the data getting ingested (monitor, scripted, etc.)? Depending on how it is set there can be a precedence issue but it should be possible. This thread may help: https://answers.splunk.com/answers/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-na...

[mdsnmss · Accepted solution]

How are you setting the sourcetype and index now? How is the data getting ingested (monitor, scripted, etc.)? Depending on how it is set there can be a precedence issue but it should be possible. This thread may help: https://answers.splunk.com/answers/6623/conditional-index-and-sourcetype-name-inputs-conf-by-file-na...

[Log_wrangler]

Thank you for your reply. I believe the issue was due to an older version I was using. Please convert to answer and I will accept.