Issue with specifying sourceype when logging data from multiple servers

[srividyareddy]

While ingesting the data all the logs from the server are falling into single source type. Can any one suggest me how data should be ingested so that source type are classified?

[gcusello]

Hi srividyareddy,
why all your logs have the same sourcetype? in this way you cannot correctly parse different logs.
Are you receiving logs from Forwarders or syslog or what?

Anyway, if there are some regexes that permit you to override sourcetype value you could use the method described at https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides or http://docs.splunk.com/Documentation/Splunk/latest/Data/Bypassautomaticsourcetypeassignment but it's better to assign sourcetype in Forwarders or syslog inputs.

The best way is to create a Technical Add-on with an inputs.conf with the correct sourcetype assignment, distributing it to your servers using a Deployment server.
Bye.
Giuseppe

[jkat54]

You add the sourcetype on the input in inputs.conf. If you are doing tcp/udp inputs you will need to dos transform based on the source ip/hostname. If you are monitoring other stuff like log files, event logs, performance counters, etc... then it's just a sourcetype=yourSourtceTypeHere in the inputs.conf stanzas.