After renaming a sourcetype, why is it only being applied to new data and not already indexed data?

[OMohi]

Hi Guys:

I have renamed a sourcetype, but after renaming the sourcetype and recycling the indexers, I only see new data being allocated to the new sourcetype. Historical data still seems to be allocated to the old sourcetype.

How do I address this problem? Do I need to clean all the eventdata from index on the indexer, stop Universal Forwarder, delete the fishbucket folder, start the indexer, and restart the forwarder? Please let me know.

Thanks

[tskinnerivsec · Accepted solution]

sourcetype is an indexed field, so when you change to a new sourcetype, it will not apply to any historical events. If you don't care about your old data, you can just clear all the eventdata in the index where that particular historical data resides. After you clear the eventdata out of the index, if you still have the source data, you would have to re-index it and it should pick up the new sourcetype that you have configured.

[bmacias84]

tskinnerivsec is correct. _time, host,index, splunk_server, sourcetype, and source are all fields performed during ingestion (index time).