https://community.splunk.com/t5/Getting-Data-In/Manual-sourcetype-for-data-input-not-persistent-when-indexed/m-p/104835#M22084 <P>I configured a data input to monitor a directory holding the csv files that will be consumed by Splunk. I manually specify 'csv' as the sourcetype in inputs.conf. However, when those csv files being indexed by Splunk, those events appearing in the app context as "csv-1" as sourcetype and some later added csv files being indexed as "csv-2" as sourcetype. </P> <P>From Splunk documentation (<A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter#How_Splunk_assigns_source_types">http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter#How_Splunk_assigns_source_types</A>), it indicated that explicit sourcetype specification will be used and it stops here. But why this is not the case for my data inputs??? </P> <P>Thanks in advance for your time in reading my question!</P> Wed, 24 Apr 2013 06:01:02 GMT benwu63 2013-04-24T06:01:02Z https://community.splunk.com/t5/Getting-Data-In/Manual-sourcetype-for-data-input-not-persistent-when-indexed/m-p/104835#M22084 <P>I configured a data input to monitor a directory holding the csv files that will be consumed by Splunk. I manually specify 'csv' as the sourcetype in inputs.conf. However, when those csv files being indexed by Splunk, those events appearing in the app context as "csv-1" as sourcetype and some later added csv files being indexed as "csv-2" as sourcetype. </P> <P>From Splunk documentation (<A href="http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter#How_Splunk_assigns_source_types">http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter#How_Splunk_assigns_source_types</A>), it indicated that explicit sourcetype specification will be used and it stops here. But why this is not the case for my data inputs??? </P> <P>Thanks in advance for your time in reading my question!</P> Wed, 24 Apr 2013 06:01:02 GMT https://community.splunk.com/t5/Getting-Data-In/Manual-sourcetype-for-data-input-not-persistent-when-indexed/m-p/104835#M22084 benwu63 2013-04-24T06:01:02Z https://community.splunk.com/t5/Getting-Data-In/Manual-sourcetype-for-data-input-not-persistent-when-indexed/m-p/104836#M22085 <P>This is an effect of using the specific sourcetype "csv". See more info in this answer for instance: <A href="http://splunk-base.splunk.com/answers/72860/sourcetypes-keep-on-multiplying">http://splunk-base.splunk.com/answers/72860/sourcetypes-keep-on-multiplying</A></P> Wed, 24 Apr 2013 06:06:54 GMT https://community.splunk.com/t5/Getting-Data-In/Manual-sourcetype-for-data-input-not-persistent-when-indexed/m-p/104836#M22085 Ayn 2013-04-24T06:06:54Z https://community.splunk.com/t5/Getting-Data-In/Manual-sourcetype-for-data-input-not-persistent-when-indexed/m-p/104837#M22086 <P>It's (still) a known bug. See the release notes.</P> Wed, 24 Apr 2013 10:49:45 GMT https://community.splunk.com/t5/Getting-Data-In/Manual-sourcetype-for-data-input-not-persistent-when-indexed/m-p/104837#M22086 kristian_kolb 2013-04-24T10:49:45Z