Why is data only coming in _raw when ingested using a Splunk forwarder?

[nidhigoyal]

When we are ingesting data through Splunk Web, it's coming perfectly fine, but when ingested through a forwarder, the data is coming only in _raw field. After applying multikv, the data format gets corrected. Can anyone suggest some solution?

[richgalloway]

Take the sourcetype you defined in the UI and add it to the forwarder's props.conf file. Then restart the forwarder.