I'm wondering if there are other locations than inputs.conf, props.conf that a sourcetype might be named/assigned. I have data that's supposed to be marked with sysinfo_binfiles. When I search for this under the app context, I see no sysinfo_binfiles. However binfiles is a sourcetype, yet I cannot find where this is set. I see in my data inputs list, that the the input source for the sourcetype sysinfo_binfiles has 0 files, so im wondering if they're being sent to another sourcetype.
UPDATE:
Ill have a look at the docs. So for the data input, I used a CIFS mount to where the files are. Then the folder looks like /mnt/server/folder1/*/binfiles.csv . The csv has a list of binaries installed. Then I specify a manual sourcetype for that input as sysinfo_binfiles . Now I browse to the app that this input is for and do a search:
index=* sourcetype="sysinfo_binfiles"
and it returns nothing. if i search the index for that the data is being submitted to, i see a sourcetype=binfiles .
... View more
