Getting Data In

Data disappearing and getting error when selecting sourcetype: "No results found...".

dwibedi03
Explorer

I have sourcetype X in Splunk prod and dev. When trying to copy data from prod and ingesting it manually in dev, and selecting sourcetype X, the data is disappearing and there is this error in the set sourcetype option:

"No results found. Please change source type, adjust source type settings, or check your source file."

Can someone help me figure out why it is happening?

0 Karma

ololdach
Builder

Hi,
there is not enough information in your post to really help you solve this. I assume, that your error lies in the way that you "copy" the data. Please make sure that the sourcetype is defined on both systems (props.conf) and that your inputs.conf specification on dev assigns the right sourcetpye to your datasource. Lacking details, I assume that you import the data "cooked" as csv. Please be aware that the dev system might behave differently as the internal fields might be missing and either need to be copied explicitly or re-assigned (_raw, _time, index, source, sourcetype, eventtype ...)
Hope it helps
Oliver

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...