Somehow I've managed to get three different sourcetypes for syslog appearing in my search results:
"syslog" 2,049,493,302 "udp:514" 5,392,394,302 "CustomLogs" 1,100,303,223
Part of the problem is I tried setting up CustomLogs in the inputs.conf file:
[udp://10.1.1.10:514] sourcetype = CustomLogs disabled = false host = customapp
But then Splunk started assigning this sourcetype to hosts other than 10.1.1.10. So my bright idea was to change the inputs.conf entry to this:
[udp://514] disabled = false sourcetype = syslog
However after a restart I'm still seeing all three sourcetype counters increasing my indexer's splunk search page. I'm at a loss as to how this is possible since I've removed all reference to CustomLogs and yet it still continues to be matched. Please help!
Might it be that while trying to configure the CustomLogs sourcetype, you've inserted a config in transforms.conf to override the sourcetype assignment based on a regex on the source or host?
I don't believe this is possible. I haven't modified the transfroms.conf file, but what is in there doesn't have any host renaming. Could it be something that the indexer has learned? I'm definitely still seeing entries for this non-existent inputs.conf entry still. Maybe I just need to tell splunk to unlearn it?
I can try that, but it doesn't explain why the # after CustomLogs is increasing & the order of "Last Seen" is changing as well, where CustomLogs will occasionally be on top of the list as the last seen entry. It's like Splunk remembers it and any host that was logging with this previously is still using this sourcetype even though it's gone....
It sounds like you're seeing old data that's already being indexed. You can rename old sourcetypes in props.conf. Just add a stanza like this in props.conf, on the indexer:
[CustomLogs] rename = syslog
Once for each sourcetype you want to rename