I know on prem you can delete the source type on the indexer, but how do you delete a sourcetype in a splunk cloud instance?
that is crazy, can we make this a future request as it fundamentally changes getting data in?
There is currently no mechanism to delete custom sourcetypes in the Splunk Cloud. If you need to delete the sourcetype, you will need to open ticket and request it be deleted.
that's crazy 😞