topic Re: DB Connect sourcetypes in Splunk Enterprise

How can to delete these leftover source types and basically start over? Is deleting the whole index the only way?

zith — Mon, 04 Apr 2022 17:45:52 GMT

Hi!

I've installed DB Connect for the first time today and can successfully get data from Oracle. While testing I've created a couple DB connect inputs with new sourcestypes (some name is required during creation) that I no longer need and that seem to be interfering with data processing - ex. new columns that I've added in SQL are not visible in new events after data fetch. I'd like to delete those source types but:

* they do not show up in Settings > Source Types
* they do show up in `| metadata type=sourcetypes index=myidx` but I don't know how to delete them using SPL

How can I delete these leftover zombie source types and basically start over. Is deleting the whole index the only way?

Re: DB Connect sourcetypes

mayurr98 — Thu, 31 Mar 2022 18:11:19 GMT

Hi please make sure "show only popular " box is unchecked in Settings > Source Types to get all the list of sourcetypes. also look for the sourcetypes on the server it is created so if you have create a sourcetype on the DB connect splunk server then look there to delete the specific sourcetype.

Please refer to this document:

https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Managesourcetypes#Delete_a_source_type

Re: DB Connect sourcetypes

zith — Thu, 31 Mar 2022 18:44:21 GMT

"Show only popular" was unchecked.

I'm not sure what you mean by needing to look on the DB connect splunk server. We currently have a single server installation. There is no separate DB Connect server nor do I see any sourcetype management related stuff inside the DB Connect App.

Anyway, I've deleted and re-created the whole index. Problem solved, I guess 😉