Problem setting sourcetype on universal forwarder

[menkurau]

We have some log data written as csv that we are attempting to index using the following inputs.conf monitor stanza:

[monitor://c:\DSView Logs]
sourcetype = dsview_event
index = oc_general
crcSalt =

with sourcetype = dsview_event the forwarder does not forward any events to the indexer. However, if I change to sourcetype = syslog, events are forwarded. From my understanding you should be able to set any arbitrary sourcetype, is that not the case? It is a v 5.0.3 UF.

[menkurau]

Problem was due to bad regex in the stanza for the sourcetype on the indexer. Once I commented that out, it started working.

[lukejadamec]

I don't see anything in the documentation that says you can create arbitrary sourcetypes:
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Whysourcetypesmatter

Try creating a sourcetype entry in the props.conf on the indexer:

[dsview_event]