Hi, which version are you using? In 6.4.3, according to inputs.conf you can use multiple groups... haven't tested. Don't know whether this works in props/transforms. One other option I have in mind is to use CLONE_SOURCETYPE and route this new sourcetype to an additional group. It's possible to do this props.conf: [orig_sourcetype] TRANSFORMS-clone = clone_orig [cloned_sourcetype] TRANSFORMS-route = route_clone transforms.conf [clone_orig] REGEX = (.*) FORMAT = $1 DEST_KEY = _raw CLONE_SOURCETYPE = cloned_sourcetype [route_clone] REGEX = . DEST_KEY=_TCP_ROUTING FORMAT=indexercluster2 outputs.conf should stay the same...? Does it work for you? You should be able to add more transforms for the "new" sourcetype... maybe even renaming it again? Or use a sourcetype alias on the second indexers group. HTH, Holger ... View more