About pbadhe

pbadhe · ‎10-11-2015

Thanks for replying. I found the issue. My sh script outputs a structured (tab delimited) data and I defined the sourcetype accordingly. The issue was I have not added the sourcetype definition in the inputs.conf of Universal forwarder. After adding sourcetype definition on UF and restarting it, I can see the fields defined in sourcetype. Still wondering though, why the sourcetype definition is required on UF since as per splunk documentation, Splunk UF do not parse the data while forwarding it. sourcetype is set in the input portion of the pipleline, not the parsing portion.

pbadhe · ‎10-10-2015

Hi Rich, Thanks for replying. I found the issue. My sh script outputs a structured (tab delimited) data and I defined the sourcetype accordingly. The issue was I have not added the sourcetype definition in the inputs.conf of Universal forwarder. After adding sourcetype definition on UF and restarting it. I can see the fields defined in sourcetype. Still wondering though, why the sourcetype definition is required on UF since as per splunk documentation, Splunk UF do not parse the data while forwarding it. Thanks, Prashant

pbadhe · ‎10-08-2015

I am using splunkforwarder-6.3.0-aa7d4b1ccb80-linux-2.6-x86_64.rpm to forward tab delimited structured data from one VM to Indexer server with splunk splunk-6.3.0-aa7d4b1ccb80-linux-2.6-x86_64.rpm installed on it. Below is the command used to add exec: ./splunk add forward-server 1.1.1.1:9997 ./splunk add exec -source "scripts/myScript.sh Device" -interval 1800 -index DeviceIndex -sourcetype DeviceSourceType Index DeviceIndex & sourcetype DeviceSourceType are created on Indexer server 1.1.1.1 When I receive the data on 1.1.1.1, the default column Sourcetype has value DeviceSourceType for all the events. But, I don't see the custom extracted fields defined in sourcetype DeviceSourceType in the search result. That means the sourcetype is not getting applied to the search results. Can anybody please let me know what is wrong? What configurations are missing? The same configurations were working in Splunk 6.2.5.

Posts	3
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎10-08-2015

Online Status	Offline
Date Last Visited	‎06-05-2020 02:04 AM

Splunk 6.3.0: Source type not getting applied to f...

Re: Splunk 6.3.0: Source type not getting applied ...

Re: Splunk 6.3.0: Source type not getting applied ...

Splunk 6.3.0: Source type not getting applied to f...