We have some log data written as csv that we are attempting to index using the following inputs.conf monitor stanza:
sourcetype = dsview_event
index = oc_general
with sourcetype = dsview_event the forwarder does not forward any events to the indexer. However, if I change to sourcetype = syslog, events are forwarded. From my understanding you should be able to set any arbitrary sourcetype, is that not the case? It is a v 5.0.3 UF.