I have two different sourcetypes that both have the same field name. Is there any way to explicitly specify a fieldname sourcetype?
Silly noob question this was. splunk doesn't care what the field name is. I changed the fieldnames in transforms.conf to something else (anything else) and it worked
Silly noob question this was. splunk doesn't care what the field name is. I changed the fieldnames in transforms.conf to something else (anything else) and it worked