How to delete sourcetypes? Can this be done via CLI?

akawacz — Thu, 17 Dec 2015 13:53:03 GMT

I would like to clean sourcetype list. Can I delete it via CLI? ( I am not talking here removing sourcetype from the index. but rather if you go to add data ->Set source -> Set Sourcetype. On that list I have a lot of not needed sourcetypes)

Thank you

Re: How to delete sourcetypes? Can this be done via CLI?

masonmorales — Thu, 17 Dec 2015 18:12:52 GMT

You can't delete the default sourcetypes, but I believe you can hide them from the "set sourcetype" list in Splunk Web. To do this, you'll need to edit (or create) the props.conf file in $SPLUNK_HOME/etc/system/local/props.conf

You'll need to add each sourcetype stanza ID to the props.conf file, and then configure pulldown_type = 0 under each stanza.

For example:
[catalina]
pulldown_type = 0

You may need to restart Splunk after making the configuration change as well. For a list of all the sourcetype IDs, you can inspect the stanza names in the $SPLUNK_HOME/etc/system/default/props.conf file.

(Edit: Technically, you could delete the default sourcetypes from the default/props.conf file, but the next time you upgrade Splunk they will just get added back, so I don't recommend it. It could cause other problems as well since Splunk relies on a lot of the default configs)

topic How to delete sourcetypes? Can this be done via CLI? in Getting Data In

How to delete sourcetypes? Can this be done via CLI?

Re: How to delete sourcetypes? Can this be done via CLI?