how to index files having matching names under different sourcetypes

[tkadale]

I am trying to index Linux logs and Windows logs. I have created separate stanzas in props.conf file for them. But my Disk and Network files of Windows logs get indexed in Sourcetype created for disk and Network of Linux logs.
I think the reason is Both these files have "Disk" and "Network" common in their filename... and i am indexing them using filename. Can anybody help me to index them separately??

Thanks in advance!

[bwooden]

The easiest way is probably to set the sourcetype in your inputs.conf file

 [monitor:///tmp]
 sourcetype = tmp

 [monitor://c:\temp]
 sourcetype = temp

Alternatively, sourcetype may be updated using props & transforms against the full or partial path (source stanza) name or the host (host stanza).

It is important to note that if the formats of the files are the same - it is usually better practice to leverage the same sourcetype and distinguish between the two at report/search time via host or source.

[tkadale]

When I have given Priority to sourc stanza, it indexed the files to correct sourcetypes. Is it necessary to give Priority when the filenames have some words common and you are indexing using filename.