topic Search based on a source type overwritten on a per-event basis not returning any events in Getting Data In

Search based on a source type overwritten on a per-event basis not returning any events

kagrze — Wed, 24 Jul 2013 07:45:08 GMT

I've implemented per-event source types assignment as described here: http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Advancedsourcetypeoverrides Basically it works. For events matching a REGEX source type is overwritten. Unfortunately when I use this source type in a search query no events are returned. Is it because override is done on a search-time instead of an index-time? Is it possible to solve this?

Re: Search based on a source type overwritten on a per-event basis not returning any events

bmacias84 — Wed, 24 Jul 2013 15:12:24 GMT

It would help if you posted the stanzas in your .conf related to this.

Re: Search based on a source type overwritten on a per-event basis not returning any events

kagrze — Wed, 24 Jul 2013 20:28:49 GMT

OK, I've solved it. I made a mistake. Instead of FORMAT = sourcetype::<your_custom_sourcetype_value> I wrote FORMAT = <your_custom_sourcetype_value> (I forgot about sourcetype::). It was hard to spot because Splunk was correctly overwriting sourcetype field in search results.