All Apps and Add-ons

removing learned sourcetype

aaronkorn
Splunk Employee
Splunk Employee

Is it possible to remove a learned sourcetype? Splunk S.o.S says we have 8 learned sourcetypes and I am trying to clean these up. I imagine I can just remove them from sourcetypes.conf and redefine these in inputs.conf? Any help is appreciated. Thanks!

1 Solution

sdaniels
Splunk Employee
Splunk Employee

The learned app has it challenges at times but it does try to learn your sourcetypes automatically. Differences in punctuation cause it to have multiple sourcetypes. You can go into the learned app directory and remove those settings in sourcetypes.conf and then explicitly set your inputs.conf to what you want the sourcetypes to be. Unfortunately this won't change any data you've already indexed under those learned sourcetypes. Also, it's not recommended to disable the learned app.

View solution in original post

sdaniels
Splunk Employee
Splunk Employee

The learned app has it challenges at times but it does try to learn your sourcetypes automatically. Differences in punctuation cause it to have multiple sourcetypes. You can go into the learned app directory and remove those settings in sourcetypes.conf and then explicitly set your inputs.conf to what you want the sourcetypes to be. Unfortunately this won't change any data you've already indexed under those learned sourcetypes. Also, it's not recommended to disable the learned app.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...