Getting Data In

How to fix conflicting Sourcetypes


My Splunk instance had a sourcetype called Netstat (csv format), when I downloaded the *Nix App (which also has a Netstat sourcetype) all the data was reformatted based on the NIX Netstat sourcetype format. I changed the .conf files so that the original Netstat sourcetype is now called Orig-Netstat and now the new data is being parsed correctly again. Is it possible to get the historical data that I used to have in netstat before I downloaded *NIX back into my format?

0 Karma

Splunk Employee
Splunk Employee

It is not possible to change the sourcetype of an event already indexed.
There is a way to create a sourcetype alias, but it will not solve all your problem.

Is the data badly parsed :

  • at index time (line breaking, timestamp recognition)
  • or a search time (field extraction...).

For the second one, you could try to change the permissions on the netstat sourcetype field extractions in the unix app to be local to the app (therefore it will not apply in the other apps you have, etc...)

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!