Hi, It would be great if some out there has a better understanding of source typing than I could give us some help.
We've recently moved from a setup whereby log insight sent logs to Syslog-NG, which then passed the information to Splunk. This was source typed in to 91 different source types.
We removed Log insight from the mix and the data now goes in to Splunk is is split in to over 300 source types. We would like the source types to be sync'ed with the previous source types. I've looked at the:-
- inputs.conf, props.conf and transforms.conf and they don't contain the source type we've been using for NSX logs.
- We are using the same HEC token number for the data coming in.
- We have script running but these aren't creating the source types in question
It would be great to hear any thoughts on this.
Rob
