Using sourcetype in input.conf in Batch mode doesn't appear to work

[robsenk]

I noticed that source is not available in the Batch mode unlike the monitor mode. I wonder if the same applies to sourcetypes? It wasn't explicitly mentioned in the docs.

[robsenk]

I have confirmed this to work in Splunk 5.0.4 build 172409. I will upgrade.

[lguinn2 · Accepted solution]

I have used sourcetype with batch inputs. Here is an example that works

[batch://myinputdirectory]
move_policy = sinkhole
index = xyz
sourcetype = xyz

[robsenk]

We upgraded but I believe the fix was from simplifying the transforms.conf. I found I didn't have the exact same environment on my test box. Thanks for you help.

[lguinn2]

Worked for me in several versions...

Do you have a typo somewhere? You might want to check everything one more time before you upgrade!

[robsenk]

Ok... that's what I have as well. I will go dig further. I should have listed the build we use. version 5.0.3, build 163460. Thanks for comment.