Data disappearing and getting error when selecting sourcetype: "No results found...".

[dwibedi03]

I have sourcetype X in Splunk prod and dev. When trying to copy data from prod and ingesting it manually in dev, and selecting sourcetype X, the data is disappearing and there is this error in the set sourcetype option:

"No results found. Please change source type, adjust source type settings, or check your source file."

Can someone help me figure out why it is happening?

[ololdach]

Hi,
there is not enough information in your post to really help you solve this. I assume, that your error lies in the way that you "copy" the data. Please make sure that the sourcetype is defined on both systems (props.conf) and that your inputs.conf specification on dev assigns the right sourcetpye to your datasource. Lacking details, I assume that you import the data "cooked" as csv. Please be aware that the dev system might behave differently as the internal fields might be missing and either need to be copied explicitly or re-assigned (_raw, _time, index, source, sourcetype, eventtype ...)
Hope it helps
Oliver