topic Re: Rename source in Splunk Search

Rename source

sriva6 — Thu, 24 Apr 2014 13:47:26 GMT

Hi,

I have created a data input in splunk but I want to change the name of the source now. Is there a way to do this?

Re: Rename source

somesoni2 — Thu, 24 Apr 2014 13:53:34 GMT

This post can help you with that.

http://answers.splunk.com/answers/90656/renaming-sourcetype-and-source-with-props-and-transforms

Re: Rename source

sriva6 — Thu, 24 Apr 2014 14:18:25 GMT

I have already tried this. This created two source names for me. Also, after editing the inputs.conf file to rename the source the new data gets indexed with the new source name and the data which was indexed prior to the rename remains with the old source name. This is not what I need.

Re: Rename source

antlefebvre — Thu, 24 Apr 2014 14:48:17 GMT

You can reindex with the new source, but once it is indexed Splunk is going to keep the events indexed as it was received. Which is why best practice would be to set up a test index you can use to verify you data is coming in as expected.