I have created a HEC which is associated with index "AAA" and soucertype"ZZZ". Is it possible to have another soucetype associated with same token , Index AAA and source type "CCC" ?
The source
, sourcetype
, and index
properties of the token only specify defaults; the sender of the data can specify any sourcetype in the event metadata as described at:
http://dev.splunk.com/view/event-collector/SP-CAAAE6P#meta