Getting Data In

renaming sourcetype

smolcj
Builder

hi ,
i want to rename the sourcetype of my app. when i searched splunk docs i came to know that there is an option called rename to do this, but
"The indexed events still contain the original source type name. The renaming occurs only at search time. "
i dont want to keep old name of the sourcetype.
how can i completely replace oldsourcetypename to newsourcetypename.
please help
thank you

Tags (2)

lguinn2
Legend

In order to completely replace the old sourcetype name with a new sourcetype name, you will have to delete the data from the index and completely reindex it.

This is a difficult task in a production environment. After you read this, you may decide that the rename option is your best choice.

You can delete the individual events using the delete command, or you can clean the entire index.

If you clean the index, then Splunk can reindex the files and directories when it restarts. (Although if you are using forwarders, you will have to reset each forwarder to resend its data. That could be messy and difficult.)

Also, if you clean the index, you could lose data from scripted inputs and network inputs - and it might not be possible to recover this data.

If you use the delete command, though, you will have to manually reload only the data that was deleted. Again, this may be extremely difficult if this data is spread across your environment.

Finally, regardless of which option you chose, when you re-index the data, it will count against your Splunk daily license volume.

This is why most installations keep a staging or testing instance of Splunk around: so they can do a trial load of new data and make sure they get the sourcetype (and other settings) right, before they load any data into production...

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...