Sourcetype -too_small

[matthewcanty]

Just wanted to know how I can stop this from appearing. I've seen other answers saying that its due to the number of events. Is it possible to find out how many events? They said 100 but I have a sourcetype with over 12000 events and still has the suffix -too_small...

Many thanks

[Drainy · Accepted solution]

From props.conf heres a definition;

#******************************************************************************
# Small file settings
#******************************************************************************

PREFIX_SOURCETYPE = [true|false]
* NOTE: this attribute is only relevant to the "[too_small]" sourcetype.
* Determines the source types that are given to files smaller than 100 lines, and are therefore
  not classifiable.
* PREFIX_SOURCETYPE = false sets the source type to "too_small."
* PREFIX_SOURCETYPE = true sets the source type to "<sourcename>-too_small", where "<sourcename>"
  is a cleaned up version of the filename.
        * The advantage of PREFIX_SOURCETYPE = true is that not all small files are classified as
          the same source type, and wildcard searching is often effective.
        * For example, a Splunk search of "sourcetype=access*" will retrieve "access" files as well
          as "access-too_small" files.
* Defaults to true.

I've not hit many too_small sourcetypes in my time but is it possible it was too small and thats now the sourcetype associated with it? My understanding is that if you provide a sourcetype in a config then it will use that instead of the too_small keyword.

http://docs.splunk.com/Documentation/Splunk/5.0.1/Data/Renamesourcetypes

It might be an idea to try that and then re-index your data.

[matthewcanty]

Thank you. The rename source types half works. I now just have 3 source types with the same name...