I want to create a sourcetype in the sourcetype manager, but why does it say "sourcetype already exists"?

[mataharry]

I want to create the sourcetype AAA, that is not listed on the sourcetype manager.
But when I go to settings > sourcetypes and add it, when I save, Splunk says "sourcetype already exists"

Why ?

[yannK · Accepted solution]

You probably have the sourcetype already defined in a props.conf, but not displayed in the UI.

1 - run a btool to fund where the sourcetype is defined
./splunk cmd btool props list AAA --debug

let's say you find it in /opt/splunk/etc/app/car/local/props.conf
[AAA]
LOOKUP-test= dropdownsLookup host OUTPUT truck_category car_group

2 - add the settings
category = Custom
pulldown_type = 1

3- reload/restart splunk, and they should now be exposed not the manager UI