Hi, It would be great if some out there has a better understanding of source typing than I could give us some help.
We've recently moved from a setup whereby log insight sent logs to Syslog-NG, which then passed the information to Splunk. This was source typed in to 91 different source types.
We removed Log insight from the mix and the data now goes in to Splunk is is split in to over 300 source types. We would like the source types to be sync'ed with the previous source types. I've looked at the:-
It would be great to hear any thoughts on this.
Rob
This has been resolved
@robduk2 For the benefit of other readers, please explain how you resolved the problem.