https://community.splunk.com/t5/Getting-Data-In/Why-is-data-only-coming-in-raw-when-ingested-using-a-Splunk/m-p/206004#M40673 <P>Take the sourcetype you defined in the UI and add it to the forwarder's props.conf file. Then restart the forwarder.</P> Mon, 07 Sep 2015 12:01:02 GMT richgalloway 2015-09-07T12:01:02Z https://community.splunk.com/t5/Getting-Data-In/Why-is-data-only-coming-in-raw-when-ingested-using-a-Splunk/m-p/206003#M40672 <P>When we are ingesting data through Splunk Web, it's coming perfectly fine, but when ingested through a forwarder, the data is coming only in _raw field. After applying multikv, the data format gets corrected. Can anyone suggest some solution?</P> Mon, 07 Sep 2015 09:46:32 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-data-only-coming-in-raw-when-ingested-using-a-Splunk/m-p/206003#M40672 nidhigoyal 2015-09-07T09:46:32Z https://community.splunk.com/t5/Getting-Data-In/Why-is-data-only-coming-in-raw-when-ingested-using-a-Splunk/m-p/206004#M40673 <P>Take the sourcetype you defined in the UI and add it to the forwarder's props.conf file. Then restart the forwarder.</P> Mon, 07 Sep 2015 12:01:02 GMT https://community.splunk.com/t5/Getting-Data-In/Why-is-data-only-coming-in-raw-when-ingested-using-a-Splunk/m-p/206004#M40673 richgalloway 2015-09-07T12:01:02Z