We were able to find the root cause. Apparently the forwarder was configured to be a HF which was expecting the TA to be deployed in the HF as well.
So initially, it was communicated that we are working on a
UF -> IDX
turned out to be a
HF -> IDX
which makes the deployed TA in the IDX not able to map the sourcetype since it should have been deployed in HF.
Thanks for the great help @esix 🙂
... View more