All Apps and Add-ons

splunk db connect doesn't show existing sourcetypes

Kozokkon
Engager

Good afternoon,
When I'm creating a new input for my dbconnection i can't select existing source-types. Even more, when I'm trying to create new one it doesn't show up in list of all source-types.
I need to specify source-type due some data transformations in transforms.conf and props.conf. Now it just ignores my transformation specifications.

This is example, it doesn't pop up even default splunk source-types
alt text

0 Karma

kheo_splunk
Splunk Employee
Splunk Employee

The reason why all the available sourcetypes are not lised is because currently, the following SPL is used to bring available sourcetypes internally.

| metadata type=sourcetypes

Splunk has identified this issue internally and the fix is on the way using the following SPL, instead.

| metadata type=sourcetypes index=*

You can run the SPL above to check the difference from your DB Connect search screen.

That being said, DB Connect will not block the input creation and users still can enter available sourcetype although the drop down does not list the sourcetype.

Please check the following Splunk documentation as reference.

http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseinputs#Parameter_set...
Source type: Enter a sourcetype field value for Splunk Enterprise to assign to queried data as it is indexed. Click the field and enter a value, or choose an existing value from the menu that appears.

Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...