Splunk Dev

Extra data in sourcetype

prince
New Member

Hello all,

 

when I specified multiple sourcetype explicitly, I am getting some extra data  in my cim mapping charts however for corresponding query I am getting expected data only  for default single source type data was coming fine. So if there is any suggestion from any one it will be helpful.

Labels (1)
0 Karma
Get Updates on the Splunk Community!

New Release | Splunk Cloud Platform 10.1.2507

Hello Splunk Community!We are thrilled to announce the General Availability of Splunk Cloud Platform 10.1.2507 ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

🗣 You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...

Splunk New Course Releases for a Changing World

Every day, the world feels like it’s moving faster with new technological breakthroughs, AI innovation, and ...