Sourcetype missing

[pratapa]

We noticed that one of the sourcetype "wms_oracle_sessions" is missing.

when we search the following queries, no results found.

index=main sourcetype=wms_oracle_sessions

sourcetype=wms_oracle_sessions

due to which the following query is not displaying any events. No results found.

index=main sourcetype=wms_oracle_sessions | bucket span=5m _time | stats count AS sessions by _time,warehouse,machine,program | search warehouse=wk | stats sum(sessions) AS psessions by _time,program | timechart avg(psessions) by program

How can we proceed further to get this work?

Can we recreate the sourcetype?
If we recreate the sourcetype, will the data be displayed?

[codebuilder]

If you created the sourcetype via the web ui, note that it is not implemented in that process. You need to copy the output of the generated props.conf and copy it to the file itself, then cycle Splunk for it to take effect. Additionally, in order for your sourcetypes to be applied at search time, you must be searching within the context of the app to which it was applied.