We have some log data written as csv that we are attempting to index using the following inputs.conf monitor stanza:
[monitor://c:\DSView Logs]
sourcetype = dsview_event
index = oc_general
crcSalt =
with sourcetype = dsview_event the forwarder does not forward any events to the indexer. However, if I change to sourcetype = syslog, events are forwarded. From my understanding you should be able to set any arbitrary sourcetype, is that not the case? It is a v 5.0.3 UF.
Problem was due to bad regex in the stanza for the sourcetype on the indexer. Once I commented that out, it started working.
I don't see anything in the documentation that says you can create arbitrary sourcetypes:
http://docs.splunk.com/Documentation/Splunk/6.0/Data/Whysourcetypesmatter
Try creating a sourcetype entry in the props.conf on the indexer:
[dsview_event]