Building for the Splunk Platform

Is it possible to change the sourcetype of an ingested log to a different sourcetype without affecting the index?

Amoah
Explorer

I have wrongly ingested data to an existing index marked for syslog. I have noticed the error and would want changed the already ingested log to a different sourcetype? Let's say from syslog to access_combined. Is this possible? Has anyone come across this issue?

Tags (1)
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it.

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

As others have mentioned, you cannot alter data already indexed. If you correct the source type at the source so all new data utilizes the new sourcetype, the old data should eventually age out. You could also look at using an alias for the existing data with the wrong sourcetype:

http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Renamesourcetypes

Jacob
Sr. Technical Support Engineer

niketn
Legend

@Amoah you can check the collect command however, this will cost against license as by default collect command keeps sourcetype as stash and changing the same to some other sourcetype will be charged against license.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect#Moving_events_to_a_diffe...

PS: In your case index remains same but sourcetype changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it

0 Karma

splunker12er
Motivator

These are already indexed and you cannot modify - if you have the log backup then you may go ahead to delete (yoursearch sourcetype=syslog | delete)the previously indexed data and ingest the log with new source type

Amoah
Explorer

Thanks. I am appreciate it

0 Karma
Get Updates on the Splunk Community!

How I instrumented a Rust application without knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...