Getting Data In

Issue with Indexing and Sourcetype

New Member

Hello, I am using Splunk 7.2 and recently noticed a problem that I'm trying to figure out. I am using Splunk universal forwarder to collect firewall logs from a local windows machine. Logs are collecting fine and have been for quite some time. I also configured Splunk to pull out the destination IP (as DestIP) from the firewall logs and this has been parsed out correctly for weeks. Nothing has changed with my splunk configuration or windows configuration, but today I noticed that DestIP was no longer being parsed out. I also noticed that the sourcetype has changed. Sourcetype used to be pffirewall. Today it started as pffirewall-too-small. I did some searches and saw that could be the case if there are too few logs, so I ran a ping to generate more than 100 logs. Sourcename then changed to pffirewall-3. The filename that is being collected by universal forward has not changed, nor has the directory of the log location that it's being picked up from.

1) Why is the source name changing?
2) How do I prevent this from happening again?

Thank you..

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...