Getting Data In

SourceType doesn't show in Search Screen


I've been evaluating Splunk last week: creating SourceType and uploading, indexing files. Fine.

Now I switched to the Free version and I can't see the new SourceType I'm creating from now,
The Add Data process goes smoothly, new datas shows in Manager » Data inputs » Files & directories*
But doesn't show in App > Search > Source Type
And the search returns 0 (cannot find the newly created sourceType)

Is there some functional changes in Free Version ?

Are there some logs I can look at ? (from the UI there is no error/warning msg)

Tags (2)
0 Karma


This helped be solve it.

BUT all you need to do is make sure that the index this sourcetype is in is added to the list of indexes to search.

Otherwise you will have to do "index=* sourcetype=mysourcetype" instead of "sourcetype=mysourcetype"

It seems that changing licenses changed the perms associated with your roles...or something.

0 Karma

Splunk Employee
Splunk Employee

If there are new events comming constntly, you should try real time all window with;

index=* | stats count by sourcetype

If this does not show what you are looking for, try

index=* | stats count by source

To ckeck if the new sourcetype events were indexed, you should also see the sourcetype in splunk internal log, called metrics.log

index=_internal source=metrics.log per_sourcetype_thruput | timechart span=1h sum(kb) by series

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...