Getting Data In

Problem setting sourcetype on universal forwarder

Path Finder

We have some log data written as csv that we are attempting to index using the following inputs.conf monitor stanza:

[monitor://c:\DSView Logs]
sourcetype = dsview_event
index = oc_general
crcSalt =

with sourcetype = dsview_event the forwarder does not forward any events to the indexer. However, if I change to sourcetype = syslog, events are forwarded. From my understanding you should be able to set any arbitrary sourcetype, is that not the case? It is a v 5.0.3 UF.

Path Finder

Problem was due to bad regex in the stanza for the sourcetype on the indexer. Once I commented that out, it started working.

0 Karma

Super Champion

I don't see anything in the documentation that says you can create arbitrary sourcetypes:
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Whysourcetypesmatter

Try creating a sourcetype entry in the props.conf on the indexer:

[dsview_event]

0 Karma