All Apps and Add-ons

splunk db connect doesn't show existing sourcetypes

Kozokkon
Engager

Good afternoon,
When I'm creating a new input for my dbconnection i can't select existing source-types. Even more, when I'm trying to create new one it doesn't show up in list of all source-types.
I need to specify source-type due some data transformations in transforms.conf and props.conf. Now it just ignores my transformation specifications.

This is example, it doesn't pop up even default splunk source-types
alt text

0 Karma

kheo_splunk
Splunk Employee
Splunk Employee

The reason why all the available sourcetypes are not lised is because currently, the following SPL is used to bring available sourcetypes internally.

| metadata type=sourcetypes

Splunk has identified this issue internally and the fix is on the way using the following SPL, instead.

| metadata type=sourcetypes index=*

You can run the SPL above to check the difference from your DB Connect search screen.

That being said, DB Connect will not block the input creation and users still can enter available sourcetype although the drop down does not list the sourcetype.

Please check the following Splunk documentation as reference.

http://docs.splunk.com/Documentation/DBX/3.1.3/DeployDBX/Createandmanagedatabaseinputs#Parameter_set...
Source type: Enter a sourcetype field value for Splunk Enterprise to assign to queried data as it is indexed. Click the field and enter a value, or choose an existing value from the menu that appears.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...