Clients wanted a change in how there data was displayed using the sourcetype they first used. How do I remove all of what they have currently indexed so we don't get duplicate entries?
check the below link
Hope this helps.
in an Indexer Cluster, you could: