That should be possible, do you have any more detail you can provide? Do you just want to monitor the source of the data, or do you want to monitor only after an event has occurred? Splunk should be pulling the host and source information automatically, and you can search by say source=(name of source) or host=(name of host)
