Getting Data In

How do I change the sourcetype after the data has been indexed?

slin
Splunk Employee
Splunk Employee

I just installed Splunk for the first time. After some trial and error I uploaded a file but later I found that I need to change the sourcetype. Is there a way to do that?

Tags (2)
1 Solution

ChrisG
Splunk Employee
Splunk Employee

You cannot change the source type after your data has been indexed. You will have to delete it and reindex. See this previous Answers posting or this one for methods and alternatives.

View solution in original post

markwymer
Path Finder

Sorry to resurrect an old post but I'm hoping that my comment/query will prompt an expert to advise me on the same subject rather than reasking the same question in a new post.

Would it not be possible, disk space permitting, to read the data from the original source and re-index it to a new index?

I.e.

index=original_index sourcetype=original_sourcetype host=xyz | collect index=new_index sourcetype=new_sourcetype host=xyz

Would this preserve the initial meta data whilst changing the sourcetype?

Thanks,
Mark

kmuellercm
Explorer

This changes the sourcetype to 'stash' and is not configurable, just in case anyone finds this answer and thinks it's a work-around 🙂

0 Karma

johnansett
Communicator

Not true - it is configurable.  Be aware tho changing the sourcetype using collect will be metered on ingestion licenses.

0 Karma

amaynardclarku
Engager

Just what I was looking for. thanks

0 Karma

jonwatson
Engager

Yes. That worked perfectly. Thank you.

I'd give points, but I have none to give.

0 Karma

tmuthuk
Path Finder

You cannot change the source type once the data has been indexed

ChrisG
Splunk Employee
Splunk Employee

You cannot change the source type after your data has been indexed. You will have to delete it and reindex. See this previous Answers posting or this one for methods and alternatives.

Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...