Ok, thank you all VERY much for your help guys!
I think I found the reason. I seem to have tried to open and manually edit the props.conf WHILE it was being used by the Splunk software. I believe it somehow caused an error and from then onwards my defined source type was internally flagged as corrupt. I could not even get it to work after reloading Splunk. I completely deleted my props.conf and made a new one. Seems to work fine so far. From now on, I will make sure not to open it while it is being processed by Splunk.
At least that is how I think it caused problems for me. I will report back if I still encounter problems. Regards to all and thanks for helping! Great Splunk community obviously.
-SKless
... View more