Hi
I would like to clean sourcetype list. Can I delete it via CLI? ( I am not talking here removing sourcetype from the index. but rather if you go to add data ->Set source -> Set Sourcetype. On that list I have a lot of not needed sourcetypes)
Thank you
You can't delete the default sourcetypes, but I believe you can hide them from the "set sourcetype" list in Splunk Web. To do this, you'll need to edit (or create) the props.conf file in $SPLUNK_HOME/etc/system/local/props.conf
You'll need to add each sourcetype stanza ID to the props.conf file, and then configure pulldown_type = 0
under each stanza.
For example:
[catalina]
pulldown_type = 0
You may need to restart Splunk after making the configuration change as well. For a list of all the sourcetype IDs, you can inspect the stanza names in the $SPLUNK_HOME/etc/system/default/props.conf file.
(Edit: Technically, you could delete the default sourcetypes from the default/props.conf file, but the next time you upgrade Splunk they will just get added back, so I don't recommend it. It could cause other problems as well since Splunk relies on a lot of the default configs)
You can't delete the default sourcetypes, but I believe you can hide them from the "set sourcetype" list in Splunk Web. To do this, you'll need to edit (or create) the props.conf file in $SPLUNK_HOME/etc/system/local/props.conf
You'll need to add each sourcetype stanza ID to the props.conf file, and then configure pulldown_type = 0
under each stanza.
For example:
[catalina]
pulldown_type = 0
You may need to restart Splunk after making the configuration change as well. For a list of all the sourcetype IDs, you can inspect the stanza names in the $SPLUNK_HOME/etc/system/default/props.conf file.
(Edit: Technically, you could delete the default sourcetypes from the default/props.conf file, but the next time you upgrade Splunk they will just get added back, so I don't recommend it. It could cause other problems as well since Splunk relies on a lot of the default configs)