How to fix conflicting Sourcetypes

[JoeSco27]

My Splunk instance had a sourcetype called Netstat (csv format), when I downloaded the *Nix App (which also has a Netstat sourcetype) all the data was reformatted based on the NIX Netstat sourcetype format. I changed the .conf files so that the original Netstat sourcetype is now called Orig-Netstat and now the new data is being parsed correctly again. Is it possible to get the historical data that I used to have in netstat before I downloaded *NIX back into my format?

[yannK]

It is not possible to change the sourcetype of an event already indexed.
There is a way to create a sourcetype alias, but it will not solve all your problem.

Is the data badly parsed :

• at index time (line breaking, timestamp recognition)
• or a search time (field extraction...).

For the second one, you could try to change the permissions on the netstat sourcetype field extractions in the unix app to be local to the app (therefore it will not apply in the other apps you have, etc...)