Getting Data In

Problem setting sourcetype on universal forwarder

menkurau
Path Finder

We have some log data written as csv that we are attempting to index using the following inputs.conf monitor stanza:

[monitor://c:\DSView Logs]
sourcetype = dsview_event
index = oc_general
crcSalt =

with sourcetype = dsview_event the forwarder does not forward any events to the indexer. However, if I change to sourcetype = syslog, events are forwarded. From my understanding you should be able to set any arbitrary sourcetype, is that not the case? It is a v 5.0.3 UF.

menkurau
Path Finder

Problem was due to bad regex in the stanza for the sourcetype on the indexer. Once I commented that out, it started working.

0 Karma

lukejadamec
Super Champion

I don't see anything in the documentation that says you can create arbitrary sourcetypes:
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Whysourcetypesmatter

Try creating a sourcetype entry in the props.conf on the indexer:

[dsview_event]

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!