I have created a HEC which is associated with index "AAA" and soucertype"ZZZ". Is it possible to have another soucetype associated with same token , Index AAA and source type "CCC" ?
The source, sourcetype, and index properties of the token only specify defaults; the sender of the data can specify any sourcetype in the event metadata as described at: http://dev.splunk.com/view/event-collector/SP-CAAAE6P#meta
source
sourcetype
index
