Events with reassigned sourcetype (via props and transforms) become unsearchable

[splunkIT]

I have the following input:

--inputs.conf--
[monitor:///logs/cisco_raw.txt]
disabled = 0
sourcetype = syslog

The following props and transforms are configured to reassign the sourcetype from syslog to iosVoice, based on the hostname:

--props.conf--
[syslog]
TRANSFORMS-tr7 = set_sourcetype_cisco:ios:voice_by_host

--transforms.conf--
[set_sourcetype_cisco:ios:voice_by_host]
SOURCE_KEY = MetaData:Host
DEST_KEY = MetaData:Sourcetype
FORMAT = iosVoice
REGEX = myhost1.domain.com|myhost2.domain.com

When I search for:

index=main

Splunk is showing the correct sourcetyp: iosVoice

However, if I search:

index=main sourcetype="iosVoice"

Splunk would return 0 event. Why?

[woodcock]

Did you put this file on every one of your indexers and then bounce Splunk on each one afterward?

$SPLUNK_HOME/bin/splunk restart

[splunkIT · Accepted solution]

The solution to this problem is that the I did not use

FORMAT = sourcetype::iosVoice

for my format field in transforms.conf. This exact example is actually in the documentation for Splunk here: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides