The sourcetype can be defined in either
inputs.conf (typically on the forwarder side) if you do not set it explicitly, splunk will set one for you.
props.conf (indexer side)
transforms.conf (indexer side)
you should probably check out /opt/splunk/etc/apps/learned/local to see if an auto-assigned sourcetype has been created there.
The search heads have nothing to do with it.
... View more