How do I change the sourcetype after the data has been indexed?

[slin]

I just installed Splunk for the first time. After some trial and error I uploaded a file but later I found that I need to change the sourcetype. Is there a way to do that?

[markwymer]

Sorry to resurrect an old post but I'm hoping that my comment/query will prompt an expert to advise me on the same subject rather than reasking the same question in a new post.

Would it not be possible, disk space permitting, to read the data from the original source and re-index it to a new index?

I.e.

index=original_index sourcetype=original_sourcetype host=xyz | collect index=new_index sourcetype=new_sourcetype host=xyz

Would this preserve the initial meta data whilst changing the sourcetype?

Thanks,
Mark

[kmuellercm]

This changes the sourcetype to 'stash' and is not configurable, just in case anyone finds this answer and thinks it's a work-around 🙂

[johnansett]

Not true - it is configurable.  Be aware tho changing the sourcetype using collect will be metered on ingestion licenses.

[amaynardclarku]

Just what I was looking for. thanks

[jonwatson]

Yes. That worked perfectly. Thank you.

I'd give points, but I have none to give.

[tmuthuk]

You cannot change the source type once the data has been indexed

[ChrisG · Accepted solution]

You cannot change the source type after your data has been indexed. You will have to delete it and reindex. See this previous Answers posting or this one for methods and alternatives.