topic Re: Universal forwarder Sourcetype name changes itself in Getting Data In

Universal forwarder Sourcetype name changes itself

ea7777777 — Mon, 20 Apr 2020 13:20:38 GMT

Hello,

a Universal Forwarder (7.0.1) is watches an textfile. The parameter are following:

[default]
host = RBD9EUFN

[monitor://C:\ProgramData\Cognex\In-Sight\Splunk\Log_Cam]
index = rbg_ff1_stand_allone_ant2
sourcetype = rbg_ff1_stand_allone_ant2_sourcetype

crcSalt = <SOURCE>
followTail = 1

The strange thing is, the sourcetype name changes itself! Why?

Re: Universal forwarder Sourcetype name changes itself

codebuilder — Mon, 20 Apr 2020 13:58:16 GMT

Try this instead:

tstats count where index=rbg_ff1_stand_allone_ant2 by sourcetype

Re: Universal forwarder Sourcetype name changes itself

richgalloway — Mon, 20 Apr 2020 14:03:45 GMT

The host name in your screen shot does not match the host name in your config.

Re: Universal forwarder Sourcetype name changes itself

PavelP — Wed, 30 Sep 2020 05:03:13 GMT

Hello @ea7777777 ,

are the log files in this folder being renamed? If yes, do they have the similar suffix (1-2-2-2)?

check on indexer (and on UF too, if you use INDEXED_EXTRACTIONS or local_processing) if there is any sourcetype renaming in any transforms.conf file:

on linux:

grep -Er MetaData:Sourcetype /opt/splunk/etc/*

on Windows:

findstr /s MetaData:Sourcetype c:\ProgramFiles\Splunk\etc\*

or by using btool

splunk btool transforms list --debug |grep MetaData:Sourcetype

splunk btool transforms list --debug |findstr MetaData:Sourcetype