@sheamus69  I've made some progress.  Initial work is getting the log ingestion from syslog and overriding the SourceType. Here is my inputs.conf   [monitor:///var/log/$mask_host1$/syslog] disabled = false #initCrcLength = 800 crcSalt = <SOURCE> index = test sourcetype = uag:syslog [monitor:///var/log/$mask_host2$/syslog] disabled = false #initCrcLength = 800 crcSalt = <SOURCE> index = test sourcetype = uag:syslog [monitor:///var/log/$mask_host3$/syslog] disabled = false #initCrcLength = 800 crcSalt = <SOURCE> index = test sourcetype = uag:syslog Here is props.conf on the HF. [uag:syslog] category = Custom TRANSFORMS-uag:syslog = vmware:uag:admin, vmware:uag:audit, vmware:uag:esmanager   Here is transforms.conf the HF. [vmware:uag:admin] REGEX = uag-admin\: FORMAT = sourcetype::vmware:uag:admin DEST_KEY = MetaData:Sourcetype [vmware:uag:audit] REGEX = uag-audit\: FORMAT = sourcetype::vmware:uag:audit DEST_KEY = MetaData:Sourcetype [vmware:uag:esmanager] REGEX = uag-esmanager\: FORMAT = sourcetype::vmware:uag:esmanager DEST_KEY = MetaData:Sourcetype   Next, I'll update with field extraction if you're intrested. ... View more

https://github.com/mehransafari/Splunk_FrozenData_FIND_by_DATE_and_Restore   an script for finding frozen bucket files in time range you gave shows folders + size + start time and endtime of logs contains on  each folder log + asks to unfrozen log  it may help you ... View more

Thanks! Looks like this message falls under the Might or Might Not be configurable ... View more

So I might not need to redirect it after receiving the data if that is an option. But I guess let me better explain the use case. We act as an ISP essentially for some clients. They use traverse our firewalls and out to the internet. 1 FW for Multiple clients So the source device could be 10.1.1.6. But that device is going to have multiple client CIDR ranges. 10.2.0.0/16 = client1 10.3.0.0/16 = client2 10.4.0.0/16 = client3 sample log style Device(sourceHost) source dest 1. 10.1.1.6 client1 to google 2. 10.1.1.6 client2 to bing 3. 10.1.1.6 client3 to amazon Log #1 to index client1 Log #2 to index client2 Log #3 to index client3 Does that make more sense? If they all had separate firewalls this would be very simple, but that is not the case. If I can do this in a more efficient way I am all about doing that. ... View more