Getting Data In

Why is sourcetype defined as host in Splunk Cloud?

mygoalfinder
Explorer

I created a inputs.conf on my deployment server and noticed that my logs were coming in as my sourcetype instead of my host.  Once the I assigned it to the client, I couldn't find the logs. I noticed they were my sourcetype instead of it normally being the host. 

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

What exactly do you mean by "logs were coming in as my sourcetype instead of my host"?  Can you post a sanitized screen shot?

Please share the inputs.conf stanza.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...