How to setup 2 sourcetype for same source path in 2 hosts ?

[georgear7]

I have same source path in 2 different hosts and i want to setup 2 different source type for each server. how to do this ?

host: fela01u
source: /apps/test/*/stage/logs/*.log
sourcetype: fel_log

host: cola01u
source: /apps/test/*/stage/logs/*.log
sourcetype: col_log

When i search using source type 'col_log', it should give me the results of 'cola01u'.

[richgalloway · Accepted solution]

When you create the inputs.conf files on each host, you can specify the sourcetype.  Then. the props.conf file on your indexers tells Splunk how to process the sourcetypes.

For example, on host fela01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = fel_log
index = foo

and on host cola01u:

[monitor:///apps/test/*/state/logs/*log]
sourcetype = col_log
index = foo

Don't put those two stanzas into one file and put the one file on both hosts.  That will result in the stanzas being merged and only one sourcetype applied.

However, if these files contain similarly-structured data then they should use the same sourcetype.  Don't use sourcetype to distinguish where the data came from - that's what host and source are for.

[georgear7]

@richgalloway This worked, thanks a lot.