Good afternoon,
When I'm creating a new input for my dbconnection i can't select existing source-types. Even more, when I'm trying to create new one it doesn't show up in list of all source-types.
I need to specify source-type due some data transformations in transforms.conf and props.conf. Now it just ignores my transformation specifications.
This is example, it doesn't pop up even default splunk source-types
The reason why all the available sourcetypes are not lised is because currently, the following SPL is used to bring available sourcetypes internally.
| metadata type=sourcetypes
Splunk has identified this issue internally and the fix is on the way using the following SPL, instead.
| metadata type=sourcetypes index=*
You can run the SPL above to check the difference from your DB Connect search screen.
That being said, DB Connect will not block the input creation and users still can enter available sourcetype although the drop down does not list the sourcetype.
Please check the following Splunk documentation as reference.
http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseinputs#Parameter_set...
Source type: Enter a sourcetype field value for Splunk Enterprise to assign to queried data as it is indexed. Click the field and enter a value, or choose an existing value from the menu that appears.