topic Re: strangely Behaviuor with Sourcetype in Getting Data In

strangely Behaviuor with Sourcetype

anasshsa — Wed, 30 Sep 2020 00:17:06 GMT

I have installed a universal Forwarder on Microsoft Exchange Server and it had starting to send the data from the log files to Splunk Server. I have configured two types of Sourcetype (SEND,RECV) but strangely they became four (SEND,send-too_small,RECV,recv-too_small) and after that it had not indexed the data under SEND or RECV spurcetypes!!!!
I don't know why it's happing. Anyone have an idea!!

Thanks for help 🙂

Re: strangely Behaviuor with Sourcetype

richgalloway — Fri, 26 Apr 2019 13:20:40 GMT

The "-too_small" suffix indicates Splunk has found data which it could not match to any provided sourcetype. Make sure you have defined a sourcetype for all of the events you expect to index. Share you props.conf settings here if you need help.

Re: strangely Behaviuor with Sourcetype

PowerPacked — Fri, 26 Apr 2019 18:59:08 GMT

Splunk assigns that sourcetype to files which are having less than 100 lines or 100 events in file.

Check the PREFIX_SOURCETYPE in props.conf

Thanks