Getting Data In

Delete custom sourcetype

millern4
Communicator

We were indexing some test data in our development environment in order to manipulate it to correct an issue we are having in production. We ended up having to make a few different sourcetypes (custom) that were done through the web and now I'm having issues deleting these.

I've looked on both the indexer and the search head to remove these and I'm unable to locate them anywhere (using the GUI) and also through the CLI. I've checked props.conf, transform.conf, and indexes.conf in addition to these message boards and Splunk Admin docs.

Is there a proper procedure to permanently delete custom sourcetypes, not this sourcetype=syslog_test | delete which seems to only remove it from future searches?

Any help is appreciated and also we worth noting we have a distributed environment so would I need to do this on the search head, indexers, or both?

Tags (1)
0 Karma
1 Solution

millern4
Communicator

so it appears these were created in props.conf on our indexer:

I then modified them in the local directory under:

/splunk/etc/system/local

to remove the custom sourcetype entries we added earlier in the morning, not sure why I missed them the first time around but all is once again well.

View solution in original post

0 Karma

millern4
Communicator

so it appears these were created in props.conf on our indexer:

I then modified them in the local directory under:

/splunk/etc/system/local

to remove the custom sourcetype entries we added earlier in the morning, not sure why I missed them the first time around but all is once again well.

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...