It's my understanding that sourcetypes are defined in props.conf and potentially transforms.conf.
We have a sourcetype that is active and searchable (sourcetype=netappAuditlog), yet i cannot find the actual source type defined anywhere in those 2 files - on either the search heads (configured in a pool), or on the indexers. Is there a way to craft a search to determine where a sourcetype is defined?
Sourcetypes are indeed defined on props.conf (mostly). I don't think there is a direct search available to see the definitions of it, but your can browse the props.conf file present in default/local folders of "etc/system" or "etc/apps/"
props and transforms.conf they define the sourcetype behavior if the user wants to field extraction/filter/parse it. But i doesn't contain the definition if not required. It is just a alias for the source you want to assign from forwarder or any inputs. So what you see is the name itself given to the netappAuditlog source.