topic Re: Problem setting sourcetype on universal forwarder in Getting Data In

Problem setting sourcetype on universal forwarder

menkurau — Mon, 28 Sep 2020 15:16:45 GMT

We have some log data written as csv that we are attempting to index using the following inputs.conf monitor stanza:

[monitor://c:\DSView Logs]
sourcetype = dsview_event
index = oc_general
crcSalt =

with sourcetype = dsview_event the forwarder does not forward any events to the indexer. However, if I change to sourcetype = syslog, events are forwarded. From my understanding you should be able to set any arbitrary sourcetype, is that not the case? It is a v 5.0.3 UF.

Re: Problem setting sourcetype on universal forwarder

lukejadamec — Thu, 14 Nov 2013 17:13:32 GMT

I don't see anything in the documentation that says you can create arbitrary sourcetypes:
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Whysourcetypesmatter

Try creating a sourcetype entry in the props.conf on the indexer:

[dsview_event]

Re: Problem setting sourcetype on universal forwarder

menkurau — Thu, 14 Nov 2013 17:32:35 GMT

Problem was due to bad regex in the stanza for the sourcetype on the indexer. Once I commented that out, it started working.