How to delete sourcetypes? Can this be done via CLI?

[akawacz]

Hi

I would like to clean sourcetype list. Can I delete it via CLI? ( I am not talking here removing sourcetype from the index. but rather if you go to add data ->Set source -> Set Sourcetype. On that list I have a lot of not needed sourcetypes)

Thank you

[masonmorales · Accepted solution]

You can't delete the default sourcetypes, but I believe you can hide them from the "set sourcetype" list in Splunk Web. To do this, you'll need to edit (or create) the props.conf file in $SPLUNK_HOME/etc/system/local/props.conf

You'll need to add each sourcetype stanza ID to the props.conf file, and then configure pulldown_type = 0 under each stanza.

For example:
[catalina]
pulldown_type = 0

You may need to restart Splunk after making the configuration change as well. For a list of all the sourcetype IDs, you can inspect the stanza names in the $SPLUNK_HOME/etc/system/default/props.conf file.

(Edit: Technically, you could delete the default sourcetypes from the default/props.conf file, but the next time you upgrade Splunk they will just get added back, so I don't recommend it. It could cause other problems as well since Splunk relies on a lot of the default configs)