Splunk Dev

Is it possible to change the sourcetype of an ingested log to a different sourcetype without affecting the index?

Amoah
Explorer

I have wrongly ingested data to an existing index marked for syslog. I have noticed the error and would want changed the already ingested log to a different sourcetype? Let's say from syslog to access_combined. Is this possible? Has anyone come across this issue?

Tags (1)
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it.

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

As others have mentioned, you cannot alter data already indexed. If you correct the source type at the source so all new data utilizes the new sourcetype, the old data should eventually age out. You could also look at using an alias for the existing data with the wrong sourcetype:

http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Renamesourcetypes

Jacob
Sr. Technical Support Engineer

niketn
Legend

@Amoah you can check the collect command however, this will cost against license as by default collect command keeps sourcetype as stash and changing the same to some other sourcetype will be charged against license.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect#Moving_events_to_a_diffe...

PS: In your case index remains same but sourcetype changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it

0 Karma

splunker12er
Motivator

These are already indexed and you cannot modify - if you have the log backup then you may go ahead to delete (yoursearch sourcetype=syslog | delete)the previously indexed data and ingest the log with new source type

Amoah
Explorer

Thanks. I am appreciate it

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...