No result using sourcetype

[splunkreal]

Hello,

when using index=si_cisco we get results however if we add index=si_cisco sourcetype="cisco:ise:syslog" then no result.

The data is coming from HF (HEC) from log management system (Kafka).

Earlier today it was working with index=test sourcetype="cisco:ise:syslog" but then our log management admin changed the destination index.

I suspect props.conf/transforms.conf issue. We use Splunk Add-on for Cisco ISE 4.2.0

Thanks for your help.

[splunkreal · Accepted solution]

Hello, solution was provided by support (Poland), sourcetype:: was missing in the transforms.conf for another sourcetype in same index.

[livehybrid]

Hi @splunkreal 

In the past when I've seen this issue it has been caused by the sourcetype being overwritten at search-time, when searching without the sourcetype set it returns all the data, some of which may have its sourcetype overwritten with something like and eval/alias, and when you search for that sourcetype it doesnt return anything..

Are you aware of any props configured for that sourcetype, source or host in props.conf?

You could also try the btool command with layer:

/opt/splunk/bin/splunk cmd btool props layer "source::<yourSource>|host::<yourHostname>|<knownSourcetype>" --debug

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[isoutamo]

If needed you could install Admin little helper app from splunk base and then run this command e.g. your MC or your cloud SH.

[PickleRick]

If you get search results with simple

index=something

search but not with a more precise

index=something sourcetype=something_else

that means you have events with a different sourcetype than the one you're searching for. It's that simple.

[splunkreal]

The sourcetype appears on the left side with results... when we click on it then no result.

[PickleRick]

That is indeed a bit peculiar. If @livehybrid 's right, you can try searching for that particular sourcetype with the :: syntax

index=si_cisco sourcetype::cisco:ise:syslog

(you _don't_ want to use the quotes here)

[splunkreal]

@PickleRick reverting to index test works, weird issue.

[livehybrid]

Hi @splunkreal 

I wonder if there is a props somewhere which is doing an EVAL on the sourcetype based on the index name then? Hmmm

Are you able to do a "$SPLUNK_HOME/bin/splunk btool props list --debug" on the SH and search through the output to see if any manipulation of sourcetype is occurring? 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing