https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333166#M61614 <P>You could try renaming the sourcetype at search time:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Renamesourcetypes">https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Renamesourcetypes</A></P> <P>there is also an Answers on this:<BR /> <A href="https://answers.splunk.com/answers/145936/how-to-rename-sourcetype-in-props-conf.html">https://answers.splunk.com/answers/145936/how-to-rename-sourcetype-in-props-conf.html</A></P> Thu, 02 Mar 2017 12:58:32 GMT cmerriman 2017-03-02T12:58:32Z https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333165#M61613 <P>Hi, I want to rename the sourcetype for existing data with deleting the data from it and again indexing data because it's more difficult and over headache. So, any one please post the procedure that how I can rename the sourcetype. Or suggest me if I give alias to sourcetype for existing data is there any problems that I face in future.</P> Thu, 02 Mar 2017 06:13:17 GMT https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333165#M61613 vchigurupati 2017-03-02T06:13:17Z https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333166#M61614 <P>You could try renaming the sourcetype at search time:<BR /> <A href="https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Renamesourcetypes">https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Renamesourcetypes</A></P> <P>there is also an Answers on this:<BR /> <A href="https://answers.splunk.com/answers/145936/how-to-rename-sourcetype-in-props-conf.html">https://answers.splunk.com/answers/145936/how-to-rename-sourcetype-in-props-conf.html</A></P> Thu, 02 Mar 2017 12:58:32 GMT https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333166#M61614 cmerriman 2017-03-02T12:58:32Z https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333167#M61615 <P>Are you saying that you have existing sourcetypes that are incorrect in your indexed data, and you want to update those existing indexes to move that information into a different field? And you would like to do that without having to delete the data and re-index it?</P> Thu, 02 Mar 2017 14:24:48 GMT https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333167#M61615 DalJeanis 2017-03-02T14:24:48Z https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333168#M61616 <P>yes, exactly I want to rename single source types to mutiple source types on already indexed data </P> Wed, 29 Mar 2017 03:41:18 GMT https://community.splunk.com/t5/Getting-Data-In/Rename-sourcetype/m-p/333168#M61616 vchigurupati 2017-03-29T03:41:18Z