Getting Data In

Adding Sourcetype causes no results to come back

daniel333
Builder

Hello,

I added a transform/props for my Juniper SRX firewall logs to get sourcetyped as juniper_sa. Worked right out of the gate. BUT when I search by that source type I get no results. How ever clear as day I can see that source type on the logs

Another way of saying it is this:
as search of "index=firewall" returns events which clear as day have source type "juniper_sa" on them

a search of "index=firewall sourcetype=juniper_sa" returns no results.

I tried adding the transforms/props to my search head as well as intermediate servers. Didn't seem to matter. Same problem.

Any ideas?

0 Karma

woodcock
Esteemed Legend

The sourcetype=juniper_sa that is in your log text will not override the sourcetype=blah that Splunk will assign to your events unless you configure Splunk to do so. When you search in "Verbose" mode and click on the "All fields" hyperlink, what values does sourcetype have? I am quite sure it will not be juniper_sa. In any case, you need to provide your inputs.conf, props.conf, and transforms.conf if you would like more specific help.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...