https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-custom-sourcetype/m-p/59619#M11765 <P>What did you use for a sourcetype</P> Tue, 05 May 2015 22:41:53 GMT wrangler2x 2015-05-05T22:41:53Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-custom-sourcetype/m-p/59617#M11763 <P>I would like to forward my symfony logs using a Splunk universal forwarder. I ran a train on a sample symfony log file on my indexing machine, however I don't see my logs getting forwarded from the universal forwarders.</P> <P>Do I have to do a train on the universal forwarders as well? When I added the files to be monitored on the forwarders I did have to specify a sourcetype ("symfony") that it didn't know about.</P> <P>How does this work?</P> <P>Thanks!</P> Wed, 17 Aug 2011 22:55:02 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-custom-sourcetype/m-p/59617#M11763 mavinman 2011-08-17T22:55:02Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-custom-sourcetype/m-p/59618#M11764 <P>Never mind, there was just nothing coming into the log file. Once I sent some data in there, it got sent over properly.</P> Wed, 17 Aug 2011 23:51:15 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-custom-sourcetype/m-p/59618#M11764 mavinman 2011-08-17T23:51:15Z https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-custom-sourcetype/m-p/59619#M11765 <P>What did you use for a sourcetype</P> Tue, 05 May 2015 22:41:53 GMT https://community.splunk.com/t5/Getting-Data-In/Universal-Forwarder-and-custom-sourcetype/m-p/59619#M11765 wrangler2x 2015-05-05T22:41:53Z