Hi.
When I try to create sourcetype X in the sourcetype settings on my Splunk Cloud GUI I get an error message stating that "sourcetype X already exists. Please provide a unique name, or choose X from the list of existing sourcetypes." What "list" are they talking about? The table that shows when entering the sourcetype settings? My sourcetype X is not there.
I do have a heavy forwarder as a gateway forwarder that parses events before they reach my Splunk Cloud, and the props.conf on that heavy forwarder do have a stanza for sourcetype X. Still, as I'm going to switch to using a universal forwarder as a gateway forwarder, I want to keep a copy of my sourcetype definitions on the Splunk Cloud. Also, I've sat "pulldown_type = true" in props.conf for the sourcetype in question, so if I understand correctly, it should show in the "list of existing sourcetypes."
Any idea on what may be the problem here?
↧