Hi foufoumad, you have to ingest all sources with a sourcetype (e.g. syslog) then override the sourcetype based on regex. The main job is to identify a regex for each kind of source. For more information see at https://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides In few words: on props.conf [syslog] TRANSFORMS-changesourcetype_source1 = set_sourcetype_1 TRANSFORMS-changesourcetype_source2 = set_sourcetype_2 on transforms.conf [set_sourcetype_1] REGEX = your_regex1 FORMAT = sourcetype::your_new_sourcetype_1 DEST_KEY = MetaData:Sourcetype [set_sourcetype_2] REGEX = your_regex2 FORMAT = sourcetype::your_new_sourcetype_2 DEST_KEY = MetaData:Sourcetype Bye. Giuseppe ... View more