Why am I getting error "The events associated with this job have no sourcetype information" trying to extract a field in Hunk?

[jwalzerpitt]

I am trying to extract a field in Hunk, and I get the following error:

The events associated with this job have no sourcetype information

When I check one of the props.conf files, I see the source and sourcetype listed as such:

[source::/LogCentral/WindowsEvent/*/WindowsEventLogdata.*]
sourcetype = windows_snare_syslog

However, running a search, the sourcetype field is not showing up.

Would appreciate any help...

Thx

[splunkreal]

Same problem even with correct filename :

[monitor:///USR/xxx/app_data/yyy/logs/zzz.log]
disabled = false
index = app_xxx

[suarezry · Accepted solution]

[source::/LogCentral/WindowsEvent//WindowsEventLogdata.]

You have a "." at the end of WindowsEventLogdata...is this a typo?

[jwalzerpitt]

That was the issue. Once I removed the '.', the sourcetype field popped up as a field.

Appreciate the eagle eye!

[Sebastian2]

Just a quick idea, your source path /LogCentral/WindowsEvent//WindowsEventLogdata. looks pretty uncommon. Are you sure it isn't something like /var/log/LogCentral/WindowsEvent//WindowsEventLogdata

[jwalzerpitt]

I don't believe so as we're connecting via a virtual index to HDFS

[Sebastian2]

as @suarezry mentioned: Event the . ? Are you sure? I'd double triple check that 😉

[jwalzerpitt]

LOL - I did that exactly, but once I removed the '.', I was able to extract fields so I am 99.8% sure i'm good to go... But, you never know!