Getting Data In

Search based on a source type overwritten on a per-event basis not returning any events

kagrze
Engager

I've implemented per-event source types assignment as described here: http://docs.splunk.com/Documentation/Splunk/5.0.3/Data/Advancedsourcetypeoverrides Basically it works. For events matching a REGEX source type is overwritten. Unfortunately when I use this source type in a search query no events are returned. Is it because override is done on a search-time instead of an index-time? Is it possible to solve this?

0 Karma
1 Solution

kagrze
Engager

OK, I've solved it. I made a mistake. Instead of FORMAT = sourcetype::<your_custom_sourcetype_value> I wrote FORMAT = <your_custom_sourcetype_value> (I forgot about sourcetype::). It was hard to spot because Splunk was correctly overwriting sourcetype field in search results.

View solution in original post

kagrze
Engager

OK, I've solved it. I made a mistake. Instead of FORMAT = sourcetype::<your_custom_sourcetype_value> I wrote FORMAT = <your_custom_sourcetype_value> (I forgot about sourcetype::). It was hard to spot because Splunk was correctly overwriting sourcetype field in search results.

bmacias84
Champion

It would help if you posted the stanzas in your .conf related to this.

0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...