Getting Data In

Sourcetype missing

pratapa
Explorer

We noticed that one of the sourcetype "wms_oracle_sessions" is missing.

when we search the following queries, no results found.

index=main sourcetype=wms_oracle_sessions

sourcetype=wms_oracle_sessions

due to which the following query is not displaying any events. No results found.

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=wk | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

How can we proceed further to get this work?

Can we recreate the sourcetype?
If we recreate the sourcetype, will the data be displayed?

0 Karma

codebuilder
Influencer

If you created the sourcetype via the web ui, note that it is not implemented in that process. You need to copy the output of the generated props.conf and copy it to the file itself, then cycle Splunk for it to take effect. Additionally, in order for your sourcetypes to be applied at search time, you must be searching within the context of the app to which it was applied.

----
An upvote would be appreciated and Accept Solution if it helps!
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...