Getting Data In

How to fix conflicting Sourcetypes

JoeSco27
Communicator

My Splunk instance had a sourcetype called Netstat (csv format), when I downloaded the *Nix App (which also has a Netstat sourcetype) all the data was reformatted based on the NIX Netstat sourcetype format. I changed the .conf files so that the original Netstat sourcetype is now called Orig-Netstat and now the new data is being parsed correctly again. Is it possible to get the historical data that I used to have in netstat before I downloaded *NIX back into my format?

0 Karma

yannK
Splunk Employee
Splunk Employee

It is not possible to change the sourcetype of an event already indexed.
There is a way to create a sourcetype alias, but it will not solve all your problem.

Is the data badly parsed :

  • at index time (line breaking, timestamp recognition)
  • or a search time (field extraction...).

For the second one, you could try to change the permissions on the netstat sourcetype field extractions in the unix app to be local to the app (therefore it will not apply in the other apps you have, etc...)

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...