strangely Behaviuor with Sourcetype

[anasshsa]

I have installed a universal Forwarder on Microsoft Exchange Server and it had starting to send the data from the log files to Splunk Server. I have configured two types of Sourcetype (SEND,RECV) but strangely they became four (SEND,send-too_small,RECV,recv-too_small) and after that it had not indexed the data under SEND or RECV spurcetypes!!!!
I don't know why it's happing. Anyone have an idea!!

Thanks for help 🙂

[PowerPacked]

Hi

Splunk assigns that sourcetype to files which are having less than 100 lines or 100 events in file.

Check the PREFIX_SOURCETYPE in props.conf

Thanks

[richgalloway]

The "-too_small" suffix indicates Splunk has found data which it could not match to any provided sourcetype. Make sure you have defined a sourcetype for all of the events you expect to index. Share you props.conf settings here if you need help.