Getting Data In

How do I reset the CSV sourcetype counter?

Path Finder

I have a sourcetype, called "testcsv" that I have been testing out various CSV settings with. The file header has changed a bit over time, so I currently end up getting "sourcetype=testcsv-5" as my sourcetype. Is there a way to clear out Splunk's knowledge of old CSV headers for this sourcetype, so that it will bring in new events as "test_csv" without any numerical suffix? I know I can use sourcetype renaming, but I'd like to clear out the underlying issue rather than cover it up.

Tags (2)
0 Karma
1 Solution

Builder

You can try:

| metadata sourcetypes | delete

Hope it helps

Please be aware that this will delete all of the sourcetype records, you can filter it down by including more parameters after the metadata sourcetypes, such as sourcetype=test_csv

| metadata sourcetypes | search sourcetype=test_csv* | delete

View solution in original post

Builder

You can try:

| metadata sourcetypes | delete

Hope it helps

Please be aware that this will delete all of the sourcetype records, you can filter it down by including more parameters after the metadata sourcetypes, such as sourcetype=test_csv

| metadata sourcetypes | search sourcetype=test_csv* | delete

View solution in original post

Path Finder

I may have accepted too soon... when I try to run that command, I get the following error:

Error in 'delete' command: This command cannot be invoked after the non-streaming command 'metadata'.

0 Karma

Builder

Alternatively,
Sourcetypes only exist if data are set with them, unless they are defined in props.conf.

So delete all indexed data, using;
sourcetype=testcsv* | delete
Then re-index it, setting your sourcetype of your input to test
csv

🙂

0 Karma

Builder

Not to worry,
try using this instead in props.conf
[oldsourcetype] rename = newsourcetype]

This will rename your existing sourcetypes with one sourcetype, meaning you don't have to delete it.

Let me know if it works

0 Karma

Path Finder

Awesome, thanks!

0 Karma

Builder

Please accept the answer and vote up so that others who experience the same issue can easily locate the correct answer.

Thanks

0 Karma