Getting Data In

Issue with Indexing and Sourcetype

New Member

Hello, I am using Splunk 7.2 and recently noticed a problem that I'm trying to figure out. I am using Splunk universal forwarder to collect firewall logs from a local windows machine. Logs are collecting fine and have been for quite some time. I also configured Splunk to pull out the destination IP (as DestIP) from the firewall logs and this has been parsed out correctly for weeks. Nothing has changed with my splunk configuration or windows configuration, but today I noticed that DestIP was no longer being parsed out. I also noticed that the sourcetype has changed. Sourcetype used to be pffirewall. Today it started as pffirewall-too-small. I did some searches and saw that could be the case if there are too few logs, so I ran a ping to generate more than 100 logs. Sourcename then changed to pffirewall-3. The filename that is being collected by universal forward has not changed, nor has the directory of the log location that it's being picked up from.

1) Why is the source name changing?
2) How do I prevent this from happening again?

Thank you..

0 Karma
Get Updates on the Splunk Community!

This Week's Community Digest - Splunk Community Happenings [9.26.22]

Get the latest news and updates from the Splunk Community here! Upcoming User Group Events! 👏 Check ...

BSides Splunk 2022 - The Call for Papers is now Open!

TLDR; Main Site: CFP Site: CFP Opens: December 15th, ...

Sending Metrics to Splunk Enterprise With the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. The OpenTelemetry project is the second largest ...