Splunk forwarder, how can I forward data to same port at different server with same index name and different sourcetypes for different files?
Moreover all above is possible in light forwarder?
Could you give an example for changes on .conf files?
**Like
myindex appAsourcetype
myindex appBsourcetype
secondindex appCsourcetype (this is not a must, just extra knowledge if someone knows)
The Universal Forwarder can have index and sourcetype defined for its sources. The definition works in inputs.conf just like on a standalone Splunk instance. You'll find documentation here: http://docs.splunk.com/Documentation/Splunk/6.0.3/Data/Editinputs.conf