Hi Splunkers, My greetings !! !! I have data coming from the Syslog server for which sourcetype Is "syslog", now, I have split the data going to three diff indexers in transfroms.conf using MetaData:Index and using the regular expression like (abc* | xyz* ), and it is working fine. Now, I need to hardcode the sourcetype for each of the data going to the different index, now the sourcetype is coming as "syslog" but I want for every separate index I need to have separate sourcetype name .   Can you plz help !!  ... View more