I have a number of duplicate source types with names like "access-1", "access-2", etc. I would like to combine these into one source type ("access", for example) using the rename function in the props.conf file.
I've successfully been able to do this with single source types (changing "access-1" to "access", for example), however when I try to make multiple entries with the same source type as seen below, Splunk creates separate source types called "access".
[access-1]
rename=access
[access-2]
rename=access
According to this page, "multiple source types can share the same name", so I believe what I want to do should be possible. Would I need to use regular expressions in a single rename statement to get this working? Is there some other way to do this?
Thanks!
... View more