I want to create the sourcetype AAA, that is not listed on the sourcetype manager.
But when I go to settings > sourcetypes and add it, when I save, Splunk says "sourcetype already exists"
Why ?
You probably have the sourcetype already defined in a props.conf, but not displayed in the UI.
1 - run a btool to fund where the sourcetype is defined
./splunk cmd btool props list AAA --debug
let's say you find it in /opt/splunk/etc/app/car/local/props.conf
[AAA]
LOOKUP-test= dropdownsLookup host OUTPUT truck_category car_group
2 - add the settings
category = Custom
pulldown_type = 1
3- reload/restart splunk, and they should now be exposed not the manager UI
You probably have the sourcetype already defined in a props.conf, but not displayed in the UI.
1 - run a btool to fund where the sourcetype is defined
./splunk cmd btool props list AAA --debug
let's say you find it in /opt/splunk/etc/app/car/local/props.conf
[AAA]
LOOKUP-test= dropdownsLookup host OUTPUT truck_category car_group
2 - add the settings
category = Custom
pulldown_type = 1
3- reload/restart splunk, and they should now be exposed not the manager UI