Getting Data In

How to move data from one sourcetype to another sourcetype?



I have sourcetype "abc" which has few days data. Now we have decided to modified the sourcetype name to def . I have made the required changes and data is coming to the new sourcetype. I just want to know how I could copy old sourcetype data to the new one.

Kindly help.

Tags (2)
0 Karma


To change the indexed source and/or sourcetype after the fact, you need to export the raw data, delete it from the index, then re-import it. This is explained here:

In summary:

1) Export the logs with incorrect sourcetype so you have the raw, original logs:

 splunk search "index=myindex sourcetype=wrong_source_type" -maxout 0 -output rawdata > raw.logs

(Optionally also specify earliest=<timestamp> latest=<timestamp> -preview 0 etc.)

2) Delete the logs with incorrect sourcetype:

 index=myindex sourcetype=wrong_source_type | delete

(Use the same arguments as for the search)
(You have to add the 'delete' role to your account before doing this)

3) Re-index the raw logs:

 splunk add oneshot raw.logs -host myhost -index myindex -sourcetype correct_sourcetype -rename-source correct_source

(Without -rename-source , the new index would have source=raw.logs )

0 Karma

Community Manager
Community Manager

Hi @vishal_bandavade

Can you revisit this post and confirm if the answer below solved your question? If yes, please resolve the post by clicking "Accept" directly below @Jeremiah's answer. Don't forget to upvote any responses in the thread that were helpful for you.

0 Karma


Take a look at sourcetype renaming. You can rename your abc events to def. This doesn't reindex or move the data, it just renames the sourcetype at search time.

In your props.conf do the following:



^ @vishal_bandavade This. Your only other option is to delete and re-index the data.


and to add two important notes:

The indexed events still contain the original source type name. The renaming occurs only at search time. Also, renaming the source type does only that; it does not fix any problems with the indexed format of your event data caused by assigning the wrong source type in the first place.


Data from a renamed source type will only use the search-time configuration for the target source type 
0 Karma

Revered Legend

The renamed sourcetype will not work for searches that queries tsidx /metadata files, such as "| metadata" OR "| tstats" etc.

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...