Why is sourcetype defined as host in Splunk Cloud?

mygoalfinder · ‎04-14-2023

I created a inputs.conf on my deployment server and noticed that my logs were coming in as my sourcetype instead of my host. Once the I assigned it to the client, I couldn't find the logs. I noticed they were my sourcetype instead of it normally being the host.

richgalloway · ‎04-14-2023

What exactly do you mean by "logs were coming in as my sourcetype instead of my host"? Can you post a sanitized screen shot?

Please share the inputs.conf stanza.

---
If this reply helps you, Karma would be appreciated.

Why is sourcetype defined as host in Splunk Cloud?

host

sourcetype

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Dashboards: Hiding charts while search is being executed and other uses for tokens

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

Are you a member of the Splunk Community?

Why is sourcetype defined as host in Splunk Cloud?

host

sourcetype

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Dashboards: Hiding charts while search is being executed and other uses for tokens

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...