Monitoring Splunk

I am cloning _json sourcetype on managed splunk cloud to new custom name , the logs are not coming from log4j configuration

Nikhilsplunker
New Member

I have cloned a _json sourcetype to a custom sourcetype name and gave the correct URI for managed splunk cloud , still not being able to send logs to managed splunkcloud . I have also created a custom sourcetype cloning json_no_timestamp , it works, what are we missing
1) Is the issue on sourcetype definition or log4j configuration?
2) How to correct it ?

Tags (1)
0 Karma

Nikhilsplunker
New Member

Thanks will have a look and post back

0 Karma

woodcock
Esteemed Legend

We need more detail. In any case, check the error logs for splunkd and there is probably something there that you can fix.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...