How to get rid of a sourcetype?

[melipla]

Somehow I've managed to get three different sourcetypes for syslog appearing in my search results:

"syslog" 2,049,493,302
"udp:514" 5,392,394,302
"CustomLogs" 1,100,303,223

Part of the problem is I tried setting up CustomLogs in the inputs.conf file:

[udp://10.1.1.10:514]
sourcetype = CustomLogs
disabled = false
host = customapp

But then Splunk started assigning this sourcetype to hosts other than 10.1.1.10. So my bright idea was to change the inputs.conf entry to this:

[udp://514]
disabled = false
sourcetype = syslog

However after a restart I'm still seeing all three sourcetype counters increasing my indexer's splunk search page. I'm at a loss as to how this is possible since I've removed all reference to CustomLogs and yet it still continues to be matched. Please help!

[Paolo_Prigione]

Might it be that while trying to configure the CustomLogs sourcetype, you've inserted a config in transforms.conf to override the sourcetype assignment based on a regex on the source or host?

[Paolo_Prigione]

Have you checked the etc/users// folders?
What are the data inputs listed from the manager?
Have you tried "splunk list udp" from the command line interface?

[melipla]

I don't believe this is possible. I haven't modified the transfroms.conf file, but what is in there doesn't have any host renaming. Could it be something that the indexer has learned? I'm definitely still seeing entries for this non-existent inputs.conf entry still. Maybe I just need to tell splunk to unlearn it?

Thanks.

[melipla]

I can try that, but it doesn't explain why the # after CustomLogs is increasing & the order of "Last Seen" is changing as well, where CustomLogs will occasionally be on top of the list as the last seen entry. It's like Splunk remembers it and any host that was logging with this previously is still using this sourcetype even though it's gone....

[CarlS]

It sounds like you're seeing old data that's already being indexed. You can rename old sourcetypes in props.conf. Just add a stanza like this in props.conf, on the indexer:

[CustomLogs]
rename = syslog

Once for each sourcetype you want to rename