I have sourcetype "abc" which has few days data. Now we have decided to modified the sourcetype name to def . I have made the required changes and data is coming to the new sourcetype. I just want to know how I could copy old sourcetype data to the new one.
To change the indexed
sourcetype after the fact, you need to export the raw data, delete it from the index, then re-import it. This is explained here: https://answers.splunk.com/answers/39756/change-source-and-sourcetype.html
1) Export the logs with incorrect sourcetype so you have the raw, original logs:
splunk search "index=myindex sourcetype=wrong_source_type" -maxout 0 -output rawdata > raw.logs
(Optionally also specify
earliest=<timestamp> latest=<timestamp> -preview 0 etc.)
2) Delete the logs with incorrect sourcetype:
index=myindex sourcetype=wrong_source_type | delete
(Use the same arguments as for the search)
(You have to add the 'delete' role to your account before doing this)
3) Re-index the raw logs:
splunk add oneshot raw.logs -host myhost -index myindex -sourcetype correct_sourcetype -rename-source correct_source
-rename-source , the new index would have
Can you revisit this post and confirm if the answer below solved your question? If yes, please resolve the post by clicking "Accept" directly below @Jeremiah's answer. Don't forget to upvote any responses in the thread that were helpful for you.
Take a look at sourcetype renaming. You can rename your abc events to def. This doesn't reindex or move the data, it just renames the sourcetype at search time.
In your props.conf do the following:
and to add two important notes:
The indexed events still contain the original source type name. The renaming occurs only at search time. Also, renaming the source type does only that; it does not fix any problems with the indexed format of your event data caused by assigning the wrong source type in the first place.
Data from a renamed source type will only use the search-time configuration for the target source type