Hi there, You could approach this in a couple of ways. Maybe splitting out the data sources into 2 different files and then configure splunk for each could be the easiest bet. If this is not an option: To fix sourcetype you could create a props.conf config on source and reference a transform that assigns the sourcetype: props.conf: [source:...] TRANSFORMS-sourcetype = syslogSourcetype, trapSourcetype transforms.conf [syslogSourcetype] REGEX= TypeLog=Syslog DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::syslog [trapSourcetype] REGEX= TypeLog=Trap DEST_KEY = MetaData:Sourcetype FORMAT = sourcetype::trap As for the timestamp recognition you could look into a custom datetime.xml config. http://blogs.splunk.com/2014/04/23/its-that-time-again/ Cheers ... View more