How do I select different sourcetypes for multiple logs coming from multiple servers (no universal forwarders, using rsyslog.conf)? When I set up the input port, it only offers one type of sourcetype choice.
Answered, but I wanted to suggest that you consider sending your syslog traffic to a syslog-ng server, do your filtering/tagging there and write to separate files that are then processed by a UF.
Sending syslog traffic directly to your indexer will mean you will lose events whenever you have to restart your indexer.
Or you can follow this RSysLog 8.15.0 guide I wrote specifically for Splunk usage.
https://answers.splunk.com/answers/337489/howto-setup-rsyslog-network-event-log-filtering-ba.html
This is needs to be done
http://docs.splunk.com/Documentation/Splunk/6.2.0/Data/Advancedsourcetypeoverrides