https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72938#M14909 <P>I have used sourcetype with batch inputs. Here is an example that works</P> <PRE><CODE>[batch://myinputdirectory] move_policy = sinkhole index = xyz sourcetype = xyz </CODE></PRE> Wed, 25 Sep 2013 16:45:53 GMT lguinn2 2013-09-25T16:45:53Z https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72937#M14908 <P>I noticed that source is not available in the Batch mode unlike the monitor mode. I wonder if the same applies to sourcetypes? It wasn't explicitly mentioned in the docs. </P> Wed, 25 Sep 2013 16:08:34 GMT https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72937#M14908 robsenk 2013-09-25T16:08:34Z https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72938#M14909 <P>I have used sourcetype with batch inputs. Here is an example that works</P> <PRE><CODE>[batch://myinputdirectory] move_policy = sinkhole index = xyz sourcetype = xyz </CODE></PRE> Wed, 25 Sep 2013 16:45:53 GMT https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72938#M14909 lguinn2 2013-09-25T16:45:53Z https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72939#M14910 <P>Ok... that's what I have as well. I will go dig further. I should have listed the build we use. version 5.0.3, build 163460. Thanks for comment.</P> Wed, 25 Sep 2013 17:20:27 GMT https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72939#M14910 robsenk 2013-09-25T17:20:27Z https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72940#M14911 <P>I have confirmed this to work in Splunk 5.0.4 build 172409. I will upgrade.</P> Wed, 25 Sep 2013 17:33:58 GMT https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72940#M14911 robsenk 2013-09-25T17:33:58Z https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72941#M14912 <P>Worked for me in several versions...</P> <P>Do you have a typo somewhere? You might want to check everything one more time before you upgrade!</P> Wed, 25 Sep 2013 18:31:08 GMT https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72941#M14912 lguinn2 2013-09-25T18:31:08Z https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72942#M14913 <P>We upgraded but I believe the fix was from simplifying the transforms.conf. I found I didn't have the exact same environment on my test box. Thanks for you help.</P> Thu, 26 Sep 2013 18:48:14 GMT https://community.splunk.com/t5/Getting-Data-In/Using-sourcetype-in-input-conf-in-Batch-mode-doesn-t-appear-to/m-p/72942#M14913 robsenk 2013-09-26T18:48:14Z