Searching by sourcetype finds no results, searching by host finds events with that sourcetype

[responsys_cm]

I'm seeing some really weird behavior.

If I run | metadata type=sourcetypes index=XYZ, I see the sourcetype I'm looking for and the recent and latest times are within the last hour.

If I search on index=XYZ sourcetype=ABC over all time or over "before 1/1/2020", I get zero results.

If I search on index=XYZ host=10.*, I see events and the sourcetype values is the value that I'm searching for.

This is only happening to one sourcetype. Another twenty or so work fine, including other sourcetypes in the same index.

Anyone see this kind of thing before?

[renjith_nair]

@responsys_cm , is this sourcetype an extracted one using transform or set directly from the forwarder/source?