Getting Data In

Why am I not receiving any data from my new sourcetype in inputs.conf?

New Member

I have decided to use a different sourcetype for some logs which are already going into splunk (every 2 mins or so)

There is nothing wrong with my props.conf as the sourcetype is working for logs in different indexes in splunk.


disabled = false
followTail = 0
index = index1
sourcetype = newsourcetype
ignoreOlderThan = 5d

After I changed the sourcetype in props.conf I ran splunk apply cluster-bundle and everything was good.
I then changed the sourcetype in inputs.conf to newsourcetype. I then restarted splunk.

About half an hour passes.

I check on splunk: index=index1 sourcetype=newsourcetype and there were no results.
However: index=index1 sourcetype=oldsourcetype showed that logs were coming in every two minutes.

Why would my change to the sourcetype in inputs.conf not take effect?

0 Karma

Path Finder

Just changing the sourcetype shouldn't be a problem, are you routing those events based on the sourcetype? in that case you might have to check if you have any transforms that you should also take into account. is your inputs.conf in a HF or UF?

0 Karma

New Member

Thanks for replying -- I'm just really confused now. I checked on the deployment server > forwarder management tab and it says my server class does not have any clients associated with it. I just really don't know how splunk could still be receiving logs (from a server which is not dialling into splunk ?!?!?
Anyway this is a different question so thank you for your help 🙂

0 Karma


Maybe I'm misunderstanding, but you don't have to have a forwarder contact the DS for it to have data accepted by the indexers. There isn't a connection between the DS and the indexers to make that requirement even possible.

0 Karma
Get Updates on the Splunk Community!

There's No Place Like Chrome and the Splunk Platform

Watch On DemandMalware. Risky Extensions. Data Exfiltration. End-users are increasingly reliant on browsers to ...

The Great Resilience Quest: 5th Leaderboard Update

The fifth leaderboard update for The Great Resilience Quest is out >> 🏆 Check out the ...

Devesh Logendran, Splunk, and the Singapore Cyber Conquest

At this year’s Splunk University, I had the privilege of chatting with Devesh Logendran, one of the winners in ...