Getting Data In

Sourcetype changes when we moved from loginsight to syslog-ng

New Member

Hi, It would be great if some out there has a better understanding of source typing than I could give us some help.

We've recently moved from a setup whereby log insight sent logs to Syslog-NG, which then passed the information to Splunk. This was source typed in to 91 different source types.

We removed Log insight from the mix and the data now goes in to Splunk is is split in to over 300 source types. We would like the source types to be sync'ed with the previous source types. I've looked at the:-

  • inputs.conf, props.conf and transforms.conf and they don't contain the source type we've been using for NSX logs.
  • We are using the same HEC token number for the data coming in.
  • We have script running but these aren't creating the source types in question

It would be great to hear any thoughts on this.


0 Karma

New Member

This has been resolved

0 Karma


@robduk2 For the benefit of other readers, please explain how you resolved the problem.

If this reply helps you, an upvote would be appreciated.
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!