I recently added a log file to be monitored. It required me to define a custom source type in order to parse it. I noticed that my RegEx was not well defined and needed to be modified. I can find no way to modify my custom source type, or even delete it for that matter. How do I edit it?
You will have to change the configuration file of splunk.
Name of the file : "props.conf"
Location (Recommended) : $SPLUNK_DIR\etc\system\local\
Any new sourcetype you had created would have an entry similar to this
[config]
NO_BINARY_CHECK =1
pulldown_type = 1
SHOULD_LINEMERGE = true
Edit wherever you want it to, and you can create new sourcetypes here as well.
Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf