Getting Data In

I want to create a sourcetype in the sourcetype manager, but why does it say "sourcetype already exists"?

mataharry
Communicator

I want to create the sourcetype AAA, that is not listed on the sourcetype manager.
But when I go to settings > sourcetypes and add it, when I save, Splunk says "sourcetype already exists"

Why ?

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

You probably have the sourcetype already defined in a props.conf, but not displayed in the UI.

1 - run a btool to fund where the sourcetype is defined
./splunk cmd btool props list AAA --debug

let's say you find it in /opt/splunk/etc/app/car/local/props.conf
[AAA]
LOOKUP-test= dropdownsLookup host OUTPUT truck_category car_group

2 - add the settings
category = Custom
pulldown_type = 1

3- reload/restart splunk, and they should now be exposed not the manager UI

View solution in original post

yannK
Splunk Employee
Splunk Employee

You probably have the sourcetype already defined in a props.conf, but not displayed in the UI.

1 - run a btool to fund where the sourcetype is defined
./splunk cmd btool props list AAA --debug

let's say you find it in /opt/splunk/etc/app/car/local/props.conf
[AAA]
LOOKUP-test= dropdownsLookup host OUTPUT truck_category car_group

2 - add the settings
category = Custom
pulldown_type = 1

3- reload/restart splunk, and they should now be exposed not the manager UI