Same data input two apps?

[token2]

Is it possible to share a sourcetype'd data between two apps?

I have pfsense sending both firewall logs and Suricata eve json logs to the same UDP data input.  The TA-pfsense app is sourcetyping, field extracting and indexing the various syslog types from pfsense.  The TA-Suricata has the props.conf, lookups, eventtypes etc to extract relevant data from the eve json logs mixed into this UDP data stream. 

Is there a way to send the sourcetype:suricata from the TA-pfsense props to point to the TA-Suricata inputs.conf?

[richgalloway · Accepted solution]

One should not send two different sourcetypes to the same input port because, as you've learned, it can be very difficult to distinguish them later.  I recommend you do everything in your power to have the two sources arrive at two different ports.

If that is not possible then all is not necessarily lost.  I hope you are using, as is considered Best Practice, a syslog server to receive the UDP inputs.  You may be able to configure the syslog server to write the different sourcetypes to different files based upon the source addresses.  Then Splunk's universal forwarder can read each file and know each source type from the file location.