Issue with Sourcetype name

[alexspunkshell]

I am getting different sourcetype name in my logs. But I want the sourcetype name as per conf file.

Below are the screenshots of input.conf, props.conf & transforms.conf .

alexspunkshell_0-1695400950043.png

Props & Transforms

alexspunkshell_2-1695401306383.png

Inputs

alexspunkshell_3-1695401342803.png

[richgalloway]

Please use btool to ensure no other files add settings for the sourcetype.

splunk btool --debug props list vclog | grep -v "system\/default"

What query created the output in the first screenshot?

[alexspunkshell]

@richgalloway  No luck!  But I confirm there is no other files and settings.

Command used : index=vmware | stats count by sourcetype

Currently syslog is ingesting via universal forwarder.

Current configuration

input.conf
[monitor:///opt/syslog/vmware/10.149.xx.xx/*-syslog.log]
disabled = false
host_segment = 4
index = vmware-vclog
sourcetype = vclog
initCrcLength = 2048

Props.conf
[source::/opt/syslog/vmware/10.149.xx.xx/*]
TRANSFORMS-null= setnull

[vclog]
LINE_BREAKER = ([\r\n]+)\<\d+\>\d
SHOULD_LINEMERGE = false

transforms.conf
[setnull]
REGEX = ^\w+\W
DESK_KEY = queue
FORMAT = nullQueue