Hi I've just deployed Splunk 6 via the Chef cookbook on-line and I'm noticing some differences from Splunk 5. There are a LOT of "sourcetype=splunkd" messages in my general searches in a custom index I created (index=staging). Also, Splunk 6 is not allowing me to just search a sourcetype I have to first put in the index. My query "sourcetype=access_custom" is returning 0 results, but "index=staging sourcetype=access_custom" works.
My questions is, how to change this behaviors and is this something new and expected in Splunk 6 or is the configuration incorrect (maybe Chef cookbook)? I've set up many Splunk 5 architectures with lots of searches and dashboards etc. and have never seen either of these two.
Thxs
