Splunk Search

Why am I getting error "The events associated with this job have no sourcetype information" trying to extract a field in Hunk?

jwalzerpitt
Influencer

I am trying to extract a field in Hunk, and I get the following error:

The events associated with this job have no sourcetype information

When I check one of the props.conf files, I see the source and sourcetype listed as such:

[source::/LogCentral/WindowsEvent/*/WindowsEventLogdata.*]
sourcetype = windows_snare_syslog

However, running a search, the sourcetype field is not showing up.

Would appreciate any help...

Thx

0 Karma
1 Solution

suarezry
Builder

[source::/LogCentral/WindowsEvent//WindowsEventLogdata.]

You have a "." at the end of WindowsEventLogdata...is this a typo?

View solution in original post

splunkreal
Motivator

Same problem even with correct filename :

[monitor:///USR/xxx/app_data/yyy/logs/zzz.log]
disabled = false
index = app_xxx

* If this helps, please upvote or accept solution if it solved *
0 Karma

suarezry
Builder

[source::/LogCentral/WindowsEvent//WindowsEventLogdata.]

You have a "." at the end of WindowsEventLogdata...is this a typo?

jwalzerpitt
Influencer

That was the issue. Once I removed the '.', the sourcetype field popped up as a field.

Appreciate the eagle eye!

0 Karma

Sebastian2
Path Finder

Just a quick idea, your source path /LogCentral/WindowsEvent//WindowsEventLogdata. looks pretty uncommon. Are you sure it isn't something like /var/log/LogCentral/WindowsEvent//WindowsEventLogdata

0 Karma

jwalzerpitt
Influencer

I don't believe so as we're connecting via a virtual index to HDFS

0 Karma

Sebastian2
Path Finder

as @suarezry mentioned: Event the . ? Are you sure? I'd double triple check that 😉

0 Karma

jwalzerpitt
Influencer

LOL - I did that exactly, but once I removed the '.', I was able to extract fields so I am 99.8% sure i'm good to go... But, you never know!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...