Hi All:
I want to ingest a zip file that has multiple sourcetypes. Is there a mechanism on how to achieve it? Please let me know.
Thanks
A variation of this question comes up periodically, and the basic answer is "no". A sourcetype is tied to the source in a one-to-many relationship. If your source is a set of zip files, then the sourcetype will apply to the zip files in their entirety, not their contents.
A possible solution is a triggered script, which unpacks the zip and allows you to then ingest the component files individually as defined sources in their own right.