topic Trouble re-creating sourcetype after delete in Getting Data In

Trouble re-creating sourcetype after delete

lain179 — Fri, 02 Nov 2012 00:37:17 GMT

I created some incorrect logs with the command

sourcetype="DS Logs" | delete

I have can_delete permission, and the process went through without any error. Then I changed input and transforms conf files and restarted Splunk to grab correct logs, but nothing happened. I can't clean the index because I need the data in that index that belong to other sourcetypes.

Please advise.

I cannot add new source or sourcetype and monitoring the DS sourcetype doesn't work anymore

Re: Trouble re-creating sourcetype after delete

gkanapathy — Fri, 02 Nov 2012 03:24:57 GMT

see this answer: http://splunk-base.splunk.com/answers/684/after-fixing-propsconf-how-to-re-index-the-same-files-using-the-new-settings

Re: Trouble re-creating sourcetype after delete

lain179 — Fri, 02 Nov 2012 16:40:06 GMT

This command solves my problem of re-adding the same logs

./splunk add oneshot /full/path/to/file -sourcetype mysourcetype -index myindex -host myhostparam

But I have new sourcetypes, and they are not going into Splunk either. What else do I have to do?

Re: Trouble re-creating sourcetype after delete

lain179 — Fri, 02 Nov 2012 19:53:29 GMT

Never mind. It's working now. The server TCP connection had an issue and that's why it's not updating the monitored logs.