I already have sourcetypes defined for my data I am just confused as to set the source type based on the file name. Splunk monitors one folder that holds all different type of logs and i want it to automatically set the sourcetype based on the file name. For example one of the files has "nokia" (without quotes)in it. It isnt always in the same spot of the file name but it does show up at some point in every file name. How do i configure props and transforms to look for the word "nokia" and set its sourcetype to netx_nokia. Thanks in advance guys.
