topic Re: How to fix conflicting Sourcetypes in Getting Data In

How to fix conflicting Sourcetypes

JoeSco27 — Tue, 27 Aug 2013 13:51:08 GMT

My Splunk instance had a sourcetype called Netstat (csv format), when I downloaded the *Nix App (which also has a Netstat sourcetype) all the data was reformatted based on the NIX Netstat sourcetype format. I changed the .conf files so that the original Netstat sourcetype is now called Orig-Netstat and now the new data is being parsed correctly again. Is it possible to get the historical data that I used to have in netstat before I downloaded *NIX back into my format?

Re: How to fix conflicting Sourcetypes

yannK — Tue, 27 Aug 2013 14:33:10 GMT

It is not possible to change the sourcetype of an event already indexed.
There is a way to create a sourcetype alias, but it will not solve all your problem.

Is the data badly parsed :

at index time (line breaking, timestamp recognition)
or a search time (field extraction...).

For the second one, you could try to change the permissions on the netstat sourcetype field extractions in the unix app to be local to the app (therefore it will not apply in the other apps you have, etc...)