removing learned sourcetype

[aaronkorn]

Is it possible to remove a learned sourcetype? Splunk S.o.S says we have 8 learned sourcetypes and I am trying to clean these up. I imagine I can just remove them from sourcetypes.conf and redefine these in inputs.conf? Any help is appreciated. Thanks!

[sdaniels · Accepted solution]

The learned app has it challenges at times but it does try to learn your sourcetypes automatically. Differences in punctuation cause it to have multiple sourcetypes. You can go into the learned app directory and remove those settings in sourcetypes.conf and then explicitly set your inputs.conf to what you want the sourcetypes to be. Unfortunately this won't change any data you've already indexed under those learned sourcetypes. Also, it's not recommended to disable the learned app.