Getting Data In

How do I reset the CSV sourcetype counter?

adam_reber
Path Finder

I have a sourcetype, called "test_csv" that I have been testing out various CSV settings with. The file header has changed a bit over time, so I currently end up getting "sourcetype=test_csv-5" as my sourcetype. Is there a way to clear out Splunk's knowledge of old CSV headers for this sourcetype, so that it will bring in new events as "test_csv" without any numerical suffix? I know I can use sourcetype renaming, but I'd like to clear out the underlying issue rather than cover it up.

Tags (2)
0 Karma
1 Solution

markthompson
Builder

You can try:

| metadata sourcetypes | delete

Hope it helps

Please be aware that this will delete all of the sourcetype records, you can filter it down by including more parameters after the metadata sourcetypes, such as sourcetype=test_csv

| metadata sourcetypes | search sourcetype=test_csv* | delete

View solution in original post

markthompson
Builder

You can try:

| metadata sourcetypes | delete

Hope it helps

Please be aware that this will delete all of the sourcetype records, you can filter it down by including more parameters after the metadata sourcetypes, such as sourcetype=test_csv

| metadata sourcetypes | search sourcetype=test_csv* | delete

adam_reber
Path Finder

I may have accepted too soon... when I try to run that command, I get the following error:

Error in 'delete' command: This command cannot be invoked after the non-streaming command 'metadata'.

0 Karma

markthompson
Builder

Alternatively,
Sourcetypes only exist if data are set with them, unless they are defined in props.conf.

So delete all indexed data, using;
sourcetype=test_csv* | delete
Then re-index it, setting your sourcetype of your input to test_csv

🙂

0 Karma

markthompson
Builder

Not to worry,
try using this instead in props.conf
[old_sourcetype] rename = new_sourcetype]

This will rename your existing sourcetypes with one sourcetype, meaning you don't have to delete it.

Let me know if it works

0 Karma

adam_reber
Path Finder

Awesome, thanks!

0 Karma

markthompson
Builder

Please accept the answer and vote up so that others who experience the same issue can easily locate the correct answer.

Thanks

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...