@test_qweqwe how do you plan on splitting your different queries into different sourcetypes (in splunk)? I found management of the log files and separation of data quite cumbersome.