Segregate data from syslog

[francois_pigeon]

Hi,
We would like to know how to segregate the content of a syslog in different sources or source types. For example, I already have defined sources A, B & C in Splunk. This new source type comes from syslog and encompasses log data from the same sources: A, B & C but from a different server. The problem is that the log data from the syslog comes in one single stream which is a mix of all three sources. In the data itself we have ways to segregate the sources. For example, each entry starts with an IP and the name of the source: 127.0.0.1 [[sourceName.log]]. Therefore, we would like to know how to automatically segregate the data from the syslog in different sources or source types based on the data coming in. Should we use props.conf to accomplish this?

Thank you,

• Francois

[sdaniels]

Have you looked at this already?

http://docs.splunk.com/Documentation/Splunk/5.0/Data/Advancedsourcetypeoverrides