SourceType doesn't show in Search Screen

[cbauza]

I've been evaluating Splunk last week: creating SourceType and uploading, indexing files. Fine.

Now I switched to the Free version and I can't see the new SourceType I'm creating from now,
The Add Data process goes smoothly, new datas shows in Manager » Data inputs » Files & directories*
But doesn't show in App > Search > Source Type
And the search returns 0 (cannot find the newly created sourceType)

Is there some functional changes in Free Version ?

Are there some logs I can look at ? (from the UI there is no error/warning msg)

[kurtus]

This helped be solve it.

http://splunk-base.splunk.com/answers/33812/cannot-search-using-sourcetype-but-can-search-with-index

BUT all you need to do is make sure that the index this sourcetype is in is added to the list of indexes to search.

Otherwise you will have to do "index=* sourcetype=mysourcetype" instead of "sourcetype=mysourcetype"

It seems that changing licenses changed the perms associated with your roles...or something.

[Masa]

If there are new events comming constntly, you should try real time all window with;

index=* | stats count by sourcetype

If this does not show what you are looking for, try

index=* | stats count by source

To ckeck if the new sourcetype events were indexed, you should also see the sourcetype in splunk internal log, called metrics.log

index=_internal source=metrics.log per_sourcetype_thruput | timechart span=1h sum(kb) by series