topic Re: Change source name for exisiting data. in Getting Data In

Change source name for exisiting data.

Mr_Robaloba — Wed, 09 Mar 2011 20:43:57 GMT

I tried out the option "source name override" when setting up a UDP data input to replace "UDP:514" with "mynetworkSyslogs".

After making this change, can I permanently change the source name of exisiting data from this input to match the change?

I have tried doing: source="udp:514" | replace "udp:514" with "mynetworkSyslogs" in the search bar but this does not seem to make a permanent change.

Re: Change source name for exisiting data.

wollinet — Wed, 09 Mar 2011 23:03:37 GMT

You can't modify existing meta data. You have to re-index the old data.

Re: Change source name for exisiting data.

Mr_Robaloba — Wed, 23 Mar 2011 18:50:08 GMT

Thanks,
Though this seems to be a quite a limitation in Splunk.

I have been unable to locate any clear information on how to re-index my data. How do I do this?

Re: Change source name for exisiting data.

wollinet — Wed, 23 Mar 2011 21:49:58 GMT

You have to re-feed the log files. With 4.2 I think there're some new features for re-indexing. But I haven't checked them yet.