Getting Data In

How to delete sourcetypes? Can this be done via CLI?

akawacz
Path Finder

Hi

I would like to clean sourcetype list. Can I delete it via CLI? ( I am not talking here removing sourcetype from the index. but rather if you go to add data ->Set source -> Set Sourcetype. On that list I have a lot of not needed sourcetypes)

Thank you

0 Karma
1 Solution

masonmorales
Influencer

You can't delete the default sourcetypes, but I believe you can hide them from the "set sourcetype" list in Splunk Web. To do this, you'll need to edit (or create) the props.conf file in $SPLUNK_HOME/etc/system/local/props.conf

You'll need to add each sourcetype stanza ID to the props.conf file, and then configure pulldown_type = 0 under each stanza.

For example:
[catalina]
pulldown_type = 0

You may need to restart Splunk after making the configuration change as well. For a list of all the sourcetype IDs, you can inspect the stanza names in the $SPLUNK_HOME/etc/system/default/props.conf file.

(Edit: Technically, you could delete the default sourcetypes from the default/props.conf file, but the next time you upgrade Splunk they will just get added back, so I don't recommend it. It could cause other problems as well since Splunk relies on a lot of the default configs)

View solution in original post

masonmorales
Influencer

You can't delete the default sourcetypes, but I believe you can hide them from the "set sourcetype" list in Splunk Web. To do this, you'll need to edit (or create) the props.conf file in $SPLUNK_HOME/etc/system/local/props.conf

You'll need to add each sourcetype stanza ID to the props.conf file, and then configure pulldown_type = 0 under each stanza.

For example:
[catalina]
pulldown_type = 0

You may need to restart Splunk after making the configuration change as well. For a list of all the sourcetype IDs, you can inspect the stanza names in the $SPLUNK_HOME/etc/system/default/props.conf file.

(Edit: Technically, you could delete the default sourcetypes from the default/props.conf file, but the next time you upgrade Splunk they will just get added back, so I don't recommend it. It could cause other problems as well since Splunk relies on a lot of the default configs)

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!