Splunk Search

How to delete fields that I created in sourcetypes?

Mat93
New Member

Hi,

I created a source type.
Then I created new fields using delimiters.
I would like to delete those fields but I can't find how to do it.

I can't see them on the Settings > Fields > Field Extractions page.

I tried to delete the sourcetype by using the "soucetype=XX | delete" command
But when I recreate the sourcetype, fields are back...

Could you help me with this issue please ?

0 Karma

maha4
New Member

Use tool command check in transforms.conf

0 Karma

richgalloway
SplunkTrust
SplunkTrust

The delete command hides events. It has no effect on sourcetypes or other objects.

To delete the fields, edit the appropriate props.conf and remove the lines that create the fields. To find the right file, you can use 'splunk btool --debug props list '. Restart Splunk for the changes to take effect.

---
If this reply helps you, Karma would be appreciated.

Mat93
New Member

Thank you for your replies.

To edit conf files, I need a direct access to the server ?
Or I can edit conf files from the web interface ?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, you must have access to the server to be able to edit config files.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...