https://community.splunk.com/t5/Getting-Data-In/App-not-creating-sourcetypes/m-p/533885#M89643 <P>Did you install the Juniper add-on?&nbsp; It must be installed on the search head as well as the indexer or HF (whichever touches the data first).</P> Tue, 22 Dec 2020 20:26:33 GMT richgalloway 2020-12-22T20:26:33Z https://community.splunk.com/t5/Getting-Data-In/App-not-creating-sourcetypes/m-p/533878#M89642 <P>Hi folks,</P><P>I’m having an issue getting Juniper logs to show the correct sourcetype. Right now they simply all show up as “sourcetype=juniper”, instead of the expected ones like “juniper:junos:firewall”. I have the Splunk Juniper app installed, and the input selected to use the juniper sourcetype, so the right props/transforms should be breaking down more sub-sourcetypes. Am I missing a step? Thanks!</P> Tue, 22 Dec 2020 19:38:25 GMT https://community.splunk.com/t5/Getting-Data-In/App-not-creating-sourcetypes/m-p/533878#M89642 jravida 2020-12-22T19:38:25Z https://community.splunk.com/t5/Getting-Data-In/App-not-creating-sourcetypes/m-p/533885#M89643 <P>Did you install the Juniper add-on?&nbsp; It must be installed on the search head as well as the indexer or HF (whichever touches the data first).</P> Tue, 22 Dec 2020 20:26:33 GMT https://community.splunk.com/t5/Getting-Data-In/App-not-creating-sourcetypes/m-p/533885#M89643 richgalloway 2020-12-22T20:26:33Z