topic Re: Can't Preview Source Type When Uploading Data in Splunk Search

Can't Preview Source Type When Uploading Data

HankinAlex — Thu, 14 Mar 2024 20:44:36 GMT

I am trying to create a props.conf to pass a custom timestamp. To do so I wanted to upload data and use the set source type page to configure timestamp parameters and then copy the props.conf to clipboard.

However, the preview on this page does not update when I click "Apply Settings". The preview only changes when I select a new source type from the dropdown next to "Save As", changing anything in "Event Breaks", "Timestamp", or "Advanced" does nothing.

Some thing to note is there is a red exclamation point in the top left saying "Can only preview uploaded files", unsure what this means.

When I do save the data and search it, it DOES look like the source type changes I made took effect, but this really isn't a feasible way to test and configure my parameters. Any way to get this visible in "Add Data"s preview?

Re: Can't Preview Source Type When Uploading Data

isoutamo — Fri, 15 Mar 2024 21:08:32 GMT

this should works https://community.splunk.com/t5/Getting-Data-In/What-props-conf-and-transforms-conf-settings-I-need-to-onboard/m-p/582549

r. Ismo

Re: Can't Preview Source Type When Uploading Data

DomenicTroilo2 — Thu, 04 Jul 2024 14:31:21 GMT

I have the same issue and believe it is caused from the last cloud update. I have note reported this as a bug yet.