https://community.splunk.com/t5/Getting-Data-In/Issue-with-Indexing-and-Sourcetype/m-p/465537#M80249 <P>Hello, I am using Splunk 7.2 and recently noticed a problem that I'm trying to figure out. I am using Splunk universal forwarder to collect firewall logs from a local windows machine. Logs are collecting fine and have been for quite some time. I also configured Splunk to pull out the destination IP (as DestIP) from the firewall logs and this has been parsed out correctly for weeks. Nothing has changed with my splunk configuration or windows configuration, but today I noticed that DestIP was no longer being parsed out. I also noticed that the sourcetype has changed. Sourcetype used to be <STRONG>pffirewall</STRONG>. Today it started as <STRONG>pffirewall-too-small</STRONG>. I did some searches and saw that could be the case if there are too few logs, so I ran a ping to generate more than 100 logs. Sourcename then changed to <STRONG>pffirewall-3</STRONG>. The filename that is being collected by universal forward has not changed, nor has the directory of the log location that it's being picked up from. </P> <P>1) Why is the source name changing?<BR /> 2) How do I prevent this from happening again?</P> <P>Thank you..</P> Wed, 01 Apr 2020 18:26:00 GMT matthewp486 2020-04-01T18:26:00Z https://community.splunk.com/t5/Getting-Data-In/Issue-with-Indexing-and-Sourcetype/m-p/465537#M80249 <P>Hello, I am using Splunk 7.2 and recently noticed a problem that I'm trying to figure out. I am using Splunk universal forwarder to collect firewall logs from a local windows machine. Logs are collecting fine and have been for quite some time. I also configured Splunk to pull out the destination IP (as DestIP) from the firewall logs and this has been parsed out correctly for weeks. Nothing has changed with my splunk configuration or windows configuration, but today I noticed that DestIP was no longer being parsed out. I also noticed that the sourcetype has changed. Sourcetype used to be <STRONG>pffirewall</STRONG>. Today it started as <STRONG>pffirewall-too-small</STRONG>. I did some searches and saw that could be the case if there are too few logs, so I ran a ping to generate more than 100 logs. Sourcename then changed to <STRONG>pffirewall-3</STRONG>. The filename that is being collected by universal forward has not changed, nor has the directory of the log location that it's being picked up from. </P> <P>1) Why is the source name changing?<BR /> 2) How do I prevent this from happening again?</P> <P>Thank you..</P> Wed, 01 Apr 2020 18:26:00 GMT https://community.splunk.com/t5/Getting-Data-In/Issue-with-Indexing-and-Sourcetype/m-p/465537#M80249 matthewp486 2020-04-01T18:26:00Z