When we are ingesting data through Splunk Web, it's coming perfectly fine, but when ingested through a forwarder, the data is coming only in _raw field. After applying multikv, the data format gets corrected. Can anyone suggest some solution?
Take the sourcetype you defined in the UI and add it to the forwarder's props.conf file. Then restart the forwarder.
