topic Re: How do I reset the CSV sourcetype counter? in Getting Data In

How do I reset the CSV sourcetype counter?

adam_reber — Mon, 28 Sep 2020 18:59:31 GMT

I have a sourcetype, called "test_csv" that I have been testing out various CSV settings with. The file header has changed a bit over time, so I currently end up getting "sourcetype=test_csv-5" as my sourcetype. Is there a way to clear out Splunk's knowledge of old CSV headers for this sourcetype, so that it will bring in new events as "test_csv" without any numerical suffix? I know I can use sourcetype renaming, but I'd like to clear out the underlying issue rather than cover it up.

Re: How do I reset the CSV sourcetype counter?

markthompson — Mon, 23 Feb 2015 12:44:37 GMT

You can try:

| metadata sourcetypes | delete

Hope it helps

Please be aware that this will delete all of the sourcetype records, you can filter it down by including more parameters after the metadata sourcetypes, such as sourcetype=test_csv

| metadata sourcetypes | search sourcetype=test_csv* | delete

Re: How do I reset the CSV sourcetype counter?

adam_reber — Mon, 23 Feb 2015 13:07:02 GMT

Awesome, thanks!

Re: How do I reset the CSV sourcetype counter?

markthompson — Mon, 23 Feb 2015 13:14:08 GMT

Please accept the answer and vote up so that others who experience the same issue can easily locate the correct answer.

Thanks

Re: How do I reset the CSV sourcetype counter?

adam_reber — Mon, 23 Feb 2015 13:51:20 GMT

I may have accepted too soon... when I try to run that command, I get the following error:

Error in 'delete' command: This command cannot be invoked after the non-streaming command 'metadata'.

Re: How do I reset the CSV sourcetype counter?

markthompson — Mon, 28 Sep 2020 18:59:34 GMT

Not to worry,
try using this instead in props.conf
[old_sourcetype] rename = new_sourcetype]

This will rename your existing sourcetypes with one sourcetype, meaning you don't have to delete it.

Let me know if it works

Re: How do I reset the CSV sourcetype counter?

markthompson — Mon, 28 Sep 2020 18:59:37 GMT

Alternatively,
Sourcetypes only exist if data are set with them, unless they are defined in props.conf.

So delete all indexed data, using;
sourcetype=test_csv* | delete
Then re-index it, setting your sourcetype of your input to test_csv

🙂