Getting Data In

Using different stanza defined in props.conf with same index

yuwtennis
Communicator

Hi!

I would like to ask question if something like below is possible.

I already have a

index A with sourcetype A (sourcetype A defined in props.conf)

However, I want to use the same indexA with different purpose
and want to define sourcetype B in props.conf.

So ,

in search A , I want to use index A with sourcetype A

but in search B , I want to use index A with sourcetype B.

Is this possible?

Thnaks,
Yu

Tags (2)
0 Karma
1 Solution

gfuente
Motivator

Hello,

Of course it is. You only need to define the same index in your inputs. Like:

[sourcetypeA]
 index = A

[sourcetypeB]
 index = A

And then in your query filter as you need:

index= A sourcetype=sourcetypeB

Regards

View solution in original post

gfuente
Motivator

Hello,

Of course it is. You only need to define the same index in your inputs. Like:

[sourcetypeA]
 index = A

[sourcetypeB]
 index = A

And then in your query filter as you need:

index= A sourcetype=sourcetypeB

Regards

yuwtennis
Communicator

Hi gfuente.

I just want to confirm that is this to be defined in props.conf?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...