How can i rename more than one soucrtypes?
I have iis-2 iis-3 ...
Can this work? [iis*] rename=iis
See this on how to use wildcards in sourcetype stanzas.
Read the 2nd answer for a disclaimer
From there you should be able to do :
[(?:::){0}iis*] sourcetype=iis
