Getting Data In

SourceType doesn't show in Search Screen

cbauza
Engager

I've been evaluating Splunk last week: creating SourceType and uploading, indexing files. Fine.

Now I switched to the Free version and I can't see the new SourceType I'm creating from now,
The Add Data process goes smoothly, new datas shows in Manager » Data inputs » Files & directories*
But doesn't show in App > Search > Source Type
And the search returns 0 (cannot find the newly created sourceType)

Is there some functional changes in Free Version ?

Are there some logs I can look at ? (from the UI there is no error/warning msg)

Tags (2)
0 Karma

kurtus
Engager

This helped be solve it.

http://splunk-base.splunk.com/answers/33812/cannot-search-using-sourcetype-but-can-search-with-index

BUT all you need to do is make sure that the index this sourcetype is in is added to the list of indexes to search.

Otherwise you will have to do "index=* sourcetype=mysourcetype" instead of "sourcetype=mysourcetype"

It seems that changing licenses changed the perms associated with your roles...or something.

0 Karma

Masa
Splunk Employee
Splunk Employee

If there are new events comming constntly, you should try real time all window with;

index=* | stats count by sourcetype

If this does not show what you are looking for, try

index=* | stats count by source

To ckeck if the new sourcetype events were indexed, you should also see the sourcetype in splunk internal log, called metrics.log

index=_internal source=metrics.log per_sourcetype_thruput | timechart span=1h sum(kb) by series

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...