Getting Data In

Is it possible to edit a sourcetype after its creation?

atemourt
Engager

Hello Splunkers,

Is it possible to edit a sourcetype after its creation?

Thank you in advance!
Afroditi

0 Karma
1 Solution

mayurr98
Super Champion

hey @atemourt
There are two ways to edit the sourcetype manually:
first way as mention by @florianduhme and second way is by editing props.conf through CLI.
you will find this file in \etc\system\local OR \etc\system\<appname>\local
After editing the configuration restart the Splunk instance. You will see changes only for the recent data(newly indexed data) and not the historical data(already indexed data)
Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf.

NOTE: You cannot change the source type after your data has been indexed. You will have to delete it and reindex.

let me know if this helps!

View solution in original post

ddrillic
Ultra Champion

We dealt with a related issue recently at Is it possible to generate the sourcetype based on the source?

0 Karma

mayurr98
Super Champion

hey @atemourt
There are two ways to edit the sourcetype manually:
first way as mention by @florianduhme and second way is by editing props.conf through CLI.
you will find this file in \etc\system\local OR \etc\system\<appname>\local
After editing the configuration restart the Splunk instance. You will see changes only for the recent data(newly indexed data) and not the historical data(already indexed data)
Refer to Props.conf Splunk doc for the detailed options available for modifying props.conf.

NOTE: You cannot change the source type after your data has been indexed. You will have to delete it and reindex.

let me know if this helps!

atemourt
Engager

Thank you @mayurr98!

0 Karma

florianduhme
Path Finder

The only way I know is to go into Settings --> Sourcetypes and click on "Edit". There you can edit your settings of the sourcetype, but unfortunately, you won't get a preview of your changed settings or any sample data.
But this is probably not what you are looking for?

I guess you would need to create a new source type in order to see a preview of it with your data.

0 Karma

atemourt
Engager

Thank you @florianduhme!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out &gt;&gt; As our brave ...