Hello, the only official documentation that I see is the one in Details on splunbase did you tried that? Create a local/inputs.conf and enable either TCP or UDP: The ports can be changed as long as they match the sender Add-On. # Listen on a TCP port to receive syslog traffic from the diode # Configure incoming TCP syslog to not append a timestamp or hostname. # TCP does not strip the priority byte by default. [tcp://6003] disabled = 0 sourcetype = diode-syslog # Listen on a UDP port to receive syslog traffic from the diode # Configure incoming UDP syslog to not append a timestamp or hostname. # UDP strips the priority byte by default. Keep it to be consistent with TCP. [udp://6004] disabled = 0 no_appending_timestamp = true no_priority_stripping = true sourcetype = diode-syslog ... View more

Hello, did you have a look at these examples in this answer? What version of splunk do you use? https://answers.splunk.com/answers/397051/can-you-regex-or-wildcard-props-sourcetype-stanzas.html ... View more