Universal Forwarder and custom sourcetype

[mavinman]

I would like to forward my symfony logs using a Splunk universal forwarder. I ran a train on a sample symfony log file on my indexing machine, however I don't see my logs getting forwarded from the universal forwarders.

Do I have to do a train on the universal forwarders as well? When I added the files to be monitored on the forwarders I did have to specify a sourcetype ("symfony") that it didn't know about.

How does this work?

Thanks!

[mavinman · Accepted solution]

Never mind, there was just nothing coming into the log file. Once I sent some data in there, it got sent over properly.

[wrangler2x]

What did you use for a sourcetype