How do I reset the CSV sourcetype counter?

[adam_reber]

I have a sourcetype, called "test_csv" that I have been testing out various CSV settings with. The file header has changed a bit over time, so I currently end up getting "sourcetype=test_csv-5" as my sourcetype. Is there a way to clear out Splunk's knowledge of old CSV headers for this sourcetype, so that it will bring in new events as "test_csv" without any numerical suffix? I know I can use sourcetype renaming, but I'd like to clear out the underlying issue rather than cover it up.

[markthompson · Accepted solution]

You can try:

| metadata sourcetypes | delete

Hope it helps

Please be aware that this will delete all of the sourcetype records, you can filter it down by including more parameters after the metadata sourcetypes, such as sourcetype=test_csv

| metadata sourcetypes | search sourcetype=test_csv* | delete

[adam_reber]

I may have accepted too soon... when I try to run that command, I get the following error:

Error in 'delete' command: This command cannot be invoked after the non-streaming command 'metadata'.

[markthompson]

Alternatively,
Sourcetypes only exist if data are set with them, unless they are defined in props.conf.

So delete all indexed data, using;
sourcetype=test_csv* | delete
Then re-index it, setting your sourcetype of your input to test_csv

🙂

[markthompson]

Not to worry,
try using this instead in props.conf
[old_sourcetype] rename = new_sourcetype]

This will rename your existing sourcetypes with one sourcetype, meaning you don't have to delete it.

Let me know if it works

[adam_reber]

Awesome, thanks!

[markthompson]

Please accept the answer and vote up so that others who experience the same issue can easily locate the correct answer.

Thanks