Hi, still learning Splunk and.....need to know..
How to delete an "source type" that is tied to indexed data. I accidentally added the source type and now want to correct it. I am using Ver. 5.0.4.
You can handle this in a few ways:
1) Delete the data (must have the can_delete capability) using | delete
2) Alias the sourcetype - add this to props.conf
rename = new_sourcetype]
3) re-index the data with the correct sourcetype.