Routing syslog streams to different index

[menkurau]

I have a stream (udp 518) of syslog coming in from two different syslog servers. I thought that I would be able to specify in inputs.conf like so:

[udp://server1:518]
sourcetype = syslog
index = index1
connection_host = dns

[udp://server2:518]
sourcetype = syslog
index = index2
connection_host = dns

This is not working. If i comment out the second stanza, i can see syslog from server1 in index1, but nothing if both are uncommented. Any thoughts?

[sdaniels]

Don't specify the server and you'll get the data from both. [udp://518]

http://docs.splunk.com/Documentation/Splunk/latest/Data/Monitornetworkports#Add_a_network_input_usin...

If is empty - [udp://port] - the port will accept data sent from any server.

Then here to specify the sourcetype etc...

http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides