How to undo a command that changed the name of my sourcetype?

[jgorman_THG]

Hello,

For some reason, when setting-up some heavy forwarders to accept syslog data on UDP 514, a colleague of mine ran the following command:

Splunk add UDP 514 -sourcetype udp:514. 

This added the following stanza to %splunkhome%/etc/apps/search/local/inputs.conf:

[udp://514]
connection_host = ip
sourcetype = udp:514

This is forcing sourcetype name "udp:514" on all the data that come in on that port.

My question is, if I just remove the "sourcetype = udp:514", will all future data be assigned the correct automatic sourcetypes?

Thanks,

JG

[skoelpin]

Yes correct. You define the sourcetype in inputs.conf which your co-worker has done. You can remove the sourcetype line and it will auto assign the sourcetype. Reminder to restart the Splunk service for this change to take affect

[jgorman_THG]

hi,

Thanks for your help.

Do I need to restart just the heavy forwarders, or the indexers as well?

Thanks,

JG

[sshelly_splunk]

You should only need to restart the heavy forwarder(s).

[jgorman_THG]

HI!

I made the change and restarted the forwarders to no avail. I also restarted the indexer for good measure, but its still showing that same sourcetype.

Can you think of what else it might be or how else I could troubleshoot this?

Thanks,

JG

[sshelly_splunk]

You can remove that sourcetype statement. THe sourcetype than will be determined by the type of data coming in. You can add something like this:
[udp//:somehostip:514]
sourcetype=somesourcetype
[udp//:someotherhostip:514]
sourcetype=someothersourcetype

The statement:
[udp//:somehostip:514]
Means, accept only from this remote host on port 514, and apply this stanza to that host's data incoming, so you can have several stanzas for each host/sourcetype combo.