Would I be able to rename a "Source Type" after the data got already indexed into Splunk?
Can I rename a type of pattern data into another "Souce Type"
or
I have to delete the type of source and reindex?
In addition, you can make splunk treat sourcetype A as if it were sourcetype B for search purposes.
http://www.splunk.com/base/Documentation/4.1.2/Admin/Renamesourcetypes
This only allows you to cause ALL of sourcetype A to now be considered B.
You Cannot rename a Source Type after it has already been indexed. However, you can use tags or aliases to alter the way you identify those events:
http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttagsandaliases
