topic Sourcetype not searcheable in Getting Data In

Sourcetype not searcheable

TiagoTLD1 — Mon, 10 Apr 2017 13:53:34 GMT

Hello,

I am facing this behaviour: when searching for thin index, I see events of sourcetype=broker, like shown in the image below.

When searching only for sourcetype=broker, no event shows up:

Any idea why?

andrey2007 — Mon, 10 Apr 2017 13:56:13 GMT

Hello, TiagoTLD1
By default splunk searches index=main (default index)
so it may be the reason of such behavior

TiagoTLD1 — Mon, 10 Apr 2017 13:57:58 GMT

Agree on that, but what about if the search "index=esi_tests sourcetype=broker" also does not return any values?

andrey2007 — Mon, 10 Apr 2017 14:15:48 GMT

Can you add sourcetype value using field picker to your search?

TiagoTLD1 — Mon, 10 Apr 2017 14:19:16 GMT

Yes I did that in my splunk. Also, to prevent hidden spaces in my sourcetype name, I used this:

index=esi_tests | search sourcetype=b*.

Also got no results

TiagoTLD1 — Mon, 10 Apr 2017 14:39:40 GMT

Thanks to @joao_amorim

Found my mistake:

[broker]
DEST_KEY = MetaData:Sourcetype
REGEX = (B1)
FORMAT = sourcetype::broker

amirrashid — Thu, 27 Dec 2018 06:53:00 GMT

@TiagoTLD1

Can u elaborate how u fix this issue as i facing the same issue and i am unable to understand what u actually did to get the results by source type.