Hi @gcusello @ITWhisperer , Thanks for your response.   Regarding the solution which you are recommending, I agree to your point. Ideally, the sourcetypes should be different for different types of events. However, in our case, we are having parent-child relationship of the sourcetypes. We are bifurcating the child sourcetype from the parent sourcetype. We observed that the TIME_PREFIX extractions were not getting applied if we defined them in the child stanza. Seems like Splunk first performs the timestamp extractions from parent and then the renaming of the sourcetype happens. So, we are trying to figure out a way in which we can handle multiple event format in the parent sourcetype stanza itself. ... View more