For some reason, when setting-up some heavy forwarders to accept syslog data on UDP 514, a colleague of mine ran the following command:
Splunk add UDP 514 -sourcetype udp:514.
This added the following stanza to %splunkhome%/etc/apps/search/local/inputs.conf:
[udp://514] connection_host = ip sourcetype = udp:514
This is forcing sourcetype name "udp:514" on all the data that come in on that port.
My question is, if I just remove the "sourcetype = udp:514", will all future data be assigned the correct automatic sourcetypes?
Yes correct. You define the sourcetype in
inputs.conf which your co-worker has done. You can remove the sourcetype line and it will auto assign the sourcetype. Reminder to restart the Splunk service for this change to take affect
I made the change and restarted the forwarders to no avail. I also restarted the indexer for good measure, but its still showing that same sourcetype.
Can you think of what else it might be or how else I could troubleshoot this?
You can remove that sourcetype statement. THe sourcetype than will be determined by the type of data coming in. You can add something like this:
Means, accept only from this remote host on port 514, and apply this stanza to that host's data incoming, so you can have several stanzas for each host/sourcetype combo.