Enable Virtualization on Multiple Log Sources

On the main toolbar, click Deployment Manager.
Click the System Monitors tab.
Double-click the Agent that collects the log source on which you want virtualization enabled.

Log Source Virtualization is supported on Windows agents and on Linux agents from System Monitor 7.5.1.8001 and later.

The System Monitor Agent Properties window appears.
In the Log Message Sources Collected by This Agent section, select the Action check box for each of the log sources that you want in the batch.
Right-click the selected log sources, and then click Properties.
The Log Message Source Properties dialog box appears.
Click the Log Source Virtualization tab.
Select the Enable Virtualization check box.
Click Create Virtual Log Sources.
The Create Virtual Log Sources dialog box appears.
From the Catch-All Log Source drop-down menu, select the log source that you want to use as the Catch-All source for child logs with unrecognized sources.

The parent source is the default Catch-All. Also remember that child log sources cannot be used as Catch-Alls.
From the Log Source Virtualization Template menu, select the virtualization template that you want to apply.
When you are finished configuring the log sources in the Create Virtual Log Sources dialog box, click the Save button.
Click the Apply button, then click OK.
Log Source Virtualization is applied to incoming logs from the parent log sources.