There is. You will need to specify this in your props/transforms files any where indexing is being performed. props.conf [source::...regex_to_match_filename] TRANSFORMS-sourcetype_naming = dynamic_sourcetype_naming transforms.conf [dynamic_sourcetype_naming] DEST_KEY = MetaData::Sourcetype SOURCE_KEY = MetaData::Source REGEX = YOUR_REGEX_TO_PULL_THE_FILENAME FORMAT = sourcetype::$1 WRITE_META = true Referances http://docs.splunk.com/Documentation/Splunk/latest/admin/Transformsconf http://docs.splunk.com/Documentation/Splunk/latest/admin/Propsconf ... View more

email has been setup, other alerts work correctly on the number of results, when you watch it realtime in search, you get 30 a minute sometimes ... View more