topic How to delete fields that I created in sourcetypes? in Splunk Search

How to delete fields that I created in sourcetypes?

Mat93 — Fri, 27 Oct 2017 12:53:17 GMT

Hi,

I created a source type.
Then I created new fields using delimiters.
I would like to delete those fields but I can't find how to do it.

I can't see them on the Settings > Fields > Field Extractions page.

I tried to delete the sourcetype by using the "soucetype=XX | delete" command
But when I recreate the sourcetype, fields are back...

Could you help me with this issue please ?

Re: How to delete fields that I created in sourcetypes?

richgalloway — Fri, 27 Oct 2017 14:37:01 GMT

The delete command hides events. It has no effect on sourcetypes or other objects.

To delete the fields, edit the appropriate props.conf and remove the lines that create the fields. To find the right file, you can use 'splunk btool --debug props list '. Restart Splunk for the changes to take effect.

Re: How to delete fields that I created in sourcetypes?

maha4 — Fri, 27 Oct 2017 14:38:08 GMT

Use tool command check in transforms.conf

Re: How to delete fields that I created in sourcetypes?

Mat93 — Fri, 27 Oct 2017 18:55:55 GMT

Thank you for your replies.

To edit conf files, I need a direct access to the server ?
Or I can edit conf files from the web interface ?

Re: How to delete fields that I created in sourcetypes?

richgalloway — Fri, 27 Oct 2017 20:04:19 GMT

Yes, you must have access to the server to be able to edit config files.