Hi,
Sorry if my question is repeated.
I have an index with sourcetype as 'firewall' and now I want to add one more sourcetype to the existing index called 'security'.
How do I achieve that? Please help.
There is no index level configuration required for a new sourcetype. Just configure your sourcetype in props.conf on Heavy forwarder/Indexers and configure your data inputs to use the existing index and new sourcetype.
Just add the new monitor and sourcetype in inputs.conf, it will starting showing the data.
If you want specific processing add configurations in props.conf for the sourcetype..