Getting Data In

Why is data only coming in _raw when ingested using a Splunk forwarder?

nidhigoyal
Explorer

When we are ingesting data through Splunk Web, it's coming perfectly fine, but when ingested through a forwarder, the data is coming only in _raw field. After applying multikv, the data format gets corrected. Can anyone suggest some solution?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Take the sourcetype you defined in the UI and add it to the forwarder's props.conf file. Then restart the forwarder.

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...