Using different stanza defined in props.conf with same index

[yuwtennis]

Hi!

I would like to ask question if something like below is possible.

I already have a

index A with sourcetype A (sourcetype A defined in props.conf)

However, I want to use the same indexA with different purpose
and want to define sourcetype B in props.conf.

So ,

in search A , I want to use index A with sourcetype A

but in search B , I want to use index A with sourcetype B.

Is this possible?

Thnaks,
Yu

[gfuente · Accepted solution]

Hello,

Of course it is. You only need to define the same index in your inputs. Like:

[sourcetypeA]
 index = A

[sourcetypeB]
 index = A

And then in your query filter as you need:

index= A sourcetype=sourcetypeB

Regards

[yuwtennis]

Hi gfuente.

I just want to confirm that is this to be defined in props.conf?