topic How to delete sourcetype or source ? in Getting Data In

How to delete sourcetype or source ?

vita86 — Wed, 14 Oct 2020 09:15:18 GMT

Hello,

I added a file csv in splunk but the name is not correct for sourcetype. And i want to restart.

now :

source="test.csv" sourcetype="csv"

I will want :

source="test.csv" sourcetype="test"

If i do this query, it's correct ?

source="test.csv" sourcetype="csv" | delete

it will delete test.csv file please ?

thanks in advance.

Regards,

Viat

Re: How to delete sourcetype or source ?

to4kawa — Wed, 14 Oct 2020 09:32:31 GMT

source="test.csv" sourcetype="csv" | delete

That's correct.

Re: How to delete sourcetype or source ?

vita86 — Wed, 14 Oct 2020 20:00:26 GMT

Thanks for your reply.

I have this error message :

Error in 'delete' command: You have insufficient privileges to delete events.

How can I do please ?

Thanks in advance

Re: How to delete sourcetype or source ?

to4kawa — Sat, 17 Oct 2020 01:26:26 GMT

Please ask your administrator for help.

Re: How to delete sourcetype or source ?

inventsekar — Sat, 17 Oct 2020 03:09:22 GMT

Yes, you have to contact your splunk admin and get your user updated with more privileges / capabilities .

as your query is resolved, please accept @to4kawa 's answer as solution. thanks. karma points appreciated!

Re: How to delete sourcetype or source ?

isoutamo — Sat, 17 Oct 2020 14:56:04 GMT

Actually there is no need to delete those events. Just load those again with correct source and sourcetype and then always use those in queries.
r. Ismo