Answers for "How to seperate different index and sourcetype?" The latest answers for the question "How to seperate different index and sourcetype?" Answer by johnwyane I know how to set index using Splunk web interface. Also, I know how to receive the data from UDF514. But I don't know about the meaning of "Format" and "$0" and "metadata" "_metadata" even I check the transforms.conf.sample file. 1 So anyone can explain it ? 2 Also, if possible , correct my configuration if anything is wrong!! 3 Should I assign different sourcetype for F5, cisco, fortigate? How? Which file? Thank you very much! Here is my configuration props.conf [F5_syslog] TRANSFORMS-F5=asm_log [cisco-router_syslog] TRANSFORM-cisco=cisco-router [fortigate_syslog] TRANSFORM-forti=fortigate transforms.conf [asm_log] REGEX = 10\.10\.10\.10|10\.10\.10\.11 DEST_KEY = _MetaData:Index FORMAT = F5_ASM [cisco-router] REGEX = 172\.16\.16\.* DEST_KEY = _MetaData:Index FORMAT = cisco_log [Fortigate] REGEX = 10\.10\.10\.20|10\.10\.10\.21 DEST_KEY = _MetaData:Index FORMAT = Forti_log For my 2nd question at windows server (with forwarder): I do nothing just using windows-ta-app. at unix server(with forwarder): [monitor:///var/log] sourcetype=unix index=unix Sat, 05 Oct 2013 07:19:01 GMT johnwyane