Hello, I am using Splunk 7.2 and recently noticed a problem that I'm trying to figure out. I am using Splunk universal forwarder to collect firewall logs from a local windows machine. Logs are collecting fine and have been for quite some time. I also configured Splunk to pull out the destination IP (as DestIP) from the firewall logs and this has been parsed out correctly for weeks. Nothing has changed with my splunk configuration or windows configuration, but today I noticed that DestIP was no longer being parsed out. I also noticed that the sourcetype has changed. Sourcetype used to be pffirewall. Today it started as pffirewall-too-small. I did some searches and saw that could be the case if there are too few logs, so I ran a ping to generate more than 100 logs. Sourcename then changed to pffirewall-3. The filename that is being collected by universal forward has not changed, nor has the directory of the log location that it's being picked up from.
1) Why is the source name changing?
2) How do I prevent this from happening again?
Thank you..
