Getting Data In

Delete custom sourcetype

millern4
Communicator

We were indexing some test data in our development environment in order to manipulate it to correct an issue we are having in production. We ended up having to make a few different sourcetypes (custom) that were done through the web and now I'm having issues deleting these.

I've looked on both the indexer and the search head to remove these and I'm unable to locate them anywhere (using the GUI) and also through the CLI. I've checked props.conf, transform.conf, and indexes.conf in addition to these message boards and Splunk Admin docs.

Is there a proper procedure to permanently delete custom sourcetypes, not this sourcetype=syslog_test | delete which seems to only remove it from future searches?

Any help is appreciated and also we worth noting we have a distributed environment so would I need to do this on the search head, indexers, or both?

Tags (1)
0 Karma
1 Solution

millern4
Communicator

so it appears these were created in props.conf on our indexer:

I then modified them in the local directory under:

/splunk/etc/system/local

to remove the custom sourcetype entries we added earlier in the morning, not sure why I missed them the first time around but all is once again well.

View solution in original post

0 Karma

millern4
Communicator

so it appears these were created in props.conf on our indexer:

I then modified them in the local directory under:

/splunk/etc/system/local

to remove the custom sourcetype entries we added earlier in the morning, not sure why I missed them the first time around but all is once again well.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...