Getting Data In

Delete custom sourcetype

millern4
Communicator

We were indexing some test data in our development environment in order to manipulate it to correct an issue we are having in production. We ended up having to make a few different sourcetypes (custom) that were done through the web and now I'm having issues deleting these.

I've looked on both the indexer and the search head to remove these and I'm unable to locate them anywhere (using the GUI) and also through the CLI. I've checked props.conf, transform.conf, and indexes.conf in addition to these message boards and Splunk Admin docs.

Is there a proper procedure to permanently delete custom sourcetypes, not this sourcetype=syslog_test | delete which seems to only remove it from future searches?

Any help is appreciated and also we worth noting we have a distributed environment so would I need to do this on the search head, indexers, or both?

Tags (1)
0 Karma
1 Solution

millern4
Communicator

so it appears these were created in props.conf on our indexer:

I then modified them in the local directory under:

/splunk/etc/system/local

to remove the custom sourcetype entries we added earlier in the morning, not sure why I missed them the first time around but all is once again well.

View solution in original post

0 Karma

millern4
Communicator

so it appears these were created in props.conf on our indexer:

I then modified them in the local directory under:

/splunk/etc/system/local

to remove the custom sourcetype entries we added earlier in the morning, not sure why I missed them the first time around but all is once again well.

0 Karma
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...