All Apps and Add-ons

removing learned sourcetype

Splunk Employee
Splunk Employee

Is it possible to remove a learned sourcetype? Splunk S.o.S says we have 8 learned sourcetypes and I am trying to clean these up. I imagine I can just remove them from sourcetypes.conf and redefine these in inputs.conf? Any help is appreciated. Thanks!

1 Solution

Splunk Employee
Splunk Employee

The learned app has it challenges at times but it does try to learn your sourcetypes automatically. Differences in punctuation cause it to have multiple sourcetypes. You can go into the learned app directory and remove those settings in sourcetypes.conf and then explicitly set your inputs.conf to what you want the sourcetypes to be. Unfortunately this won't change any data you've already indexed under those learned sourcetypes. Also, it's not recommended to disable the learned app.

View solution in original post

Splunk Employee
Splunk Employee

The learned app has it challenges at times but it does try to learn your sourcetypes automatically. Differences in punctuation cause it to have multiple sourcetypes. You can go into the learned app directory and remove those settings in sourcetypes.conf and then explicitly set your inputs.conf to what you want the sourcetypes to be. Unfortunately this won't change any data you've already indexed under those learned sourcetypes. Also, it's not recommended to disable the learned app.

View solution in original post