Splunk Search

Why does Old sourcetype is shown even when it is removed from conf files

tkadale
Path Finder

I have indexed data for Linux logs. I have created different sourcetypes for it in props.conf. Now I removed the configuration for Linux logs and created new configuration for windows logs. I have created new sourcetypes for it. I re-indexed the data. But when I search, old sourcetype still exist even though it is removed from props.conf and data is re-indexed. Is the old configuration is also saved somewhere else??
Can anybody help??

Thanks in Advance!

Tags (1)
0 Karma

woodcock
Esteemed Legend

You are seeing old data; use "rename=" to rename the old sourcetype data to the new sourcetype's name in props.conf:


[OldSourceType]
rename=NewSourceType

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

I can't tell from your post, but is this historical data that your seeing in the search? If so, this isn't going to go away unless you clean ALL eventdata from the index. All historical Sourcetypes will be retained until such time as they are purged out via your retention settings, which happen by age and size.

If you are seeing current data that is being categorized with an incorrect sourcetype, then it is likely that there is an existing configuration somewhere else that is telling Splunk to categorize this data in a certain way.

If this is a linux box from $SPLUNK_HOME/etc/ you could do something like

'find . -name *.conf | xargs grep -i yoursourcetype'

If your on windows, it should be easy to do this with the search functionality available.

This would show you any configuration that might reference this sourcetype.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...