Multiple Sources on a single host

[splunktp]

I have a Splunk 4.1.7, build 95063 instance and am trying to pull logs from Informix DB on Solaris 10. So I had set the inputs.conf of Lightweight forwarder on Informix as follows

[monitor:///usr/informix/mycertaindirectory]
disabled = false
source = Informix

On Splunkweb, I am able to see a lot of logs coming to "source=Informix".

My concern is that it also created some 3,000+ sources, most of which has the format of a common string of file name followed by a incrementing number.

How can I correct this multiple soucres coming from the same host?

[dwaddle]

Source usually correlates to a specific filename. In /usr/informix/mycertaindirectory do you have 3,000+ distinct files?

And when you say 'logs from Informix DB' do you mean the database transaction logs (the Informix physical log and logical log) or do you mean textual log files created by the Informix server process?

A common question that comes up is feeding database transaction logs into Splunk. Because most database transaction logs are in an opaque binary format, and because most database vendors are unwilling to provide documentation about that format, Splunk cannot directly ingest database transaction logs and make sense of them.