Getting Data In

Manual sourcetype for data input not persistent when indexed

benwu63
Explorer

I configured a data input to monitor a directory holding the csv files that will be consumed by Splunk. I manually specify 'csv' as the sourcetype in inputs.conf. However, when those csv files being indexed by Splunk, those events appearing in the app context as "csv-1" as sourcetype and some later added csv files being indexed as "csv-2" as sourcetype.

From Splunk documentation (http://docs.splunk.com/Documentation/Splunk/latest/Data/Whysourcetypesmatter#How_Splunk_assigns_sour...), it indicated that explicit sourcetype specification will be used and it stops here. But why this is not the case for my data inputs???

Thanks in advance for your time in reading my question!

Tags (2)
1 Solution

Ayn
Legend

This is an effect of using the specific sourcetype "csv". See more info in this answer for instance: http://splunk-base.splunk.com/answers/72860/sourcetypes-keep-on-multiplying

View solution in original post

Ayn
Legend

This is an effect of using the specific sourcetype "csv". See more info in this answer for instance: http://splunk-base.splunk.com/answers/72860/sourcetypes-keep-on-multiplying

kristian_kolb
Ultra Champion

It's (still) a known bug. See the release notes.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...