Httpevent collector logs in to splunk, not showing the host,source,sourcetype in splunk

[vijreddy30]

Hi All,

Httpevent collector logs in to splunk, not showing the host,source,sourcetype in splunk, please find the below screen shot, please help me.

[PickleRick]

That doesn't seem right. Those fields should not be empty so something must be overwriting it in search-time (or your indexes are damaged but let's assume they aren't).

Try

| tstats count where index=dfini by source sourcetype host

That should show you what are the indexed fields.

You have to search your search-time definitions to see what overwrites those values.