Getting Data In

Is there a way to disable a sourcetype in props.conf to no longer index these events?

Explorer

Hello,

I would like to disable a sourcetype defined in props.conf.
I do not want anymore events related to this sourcetype.
There is no disabled=1 in props.conf. I found LEARN_SOURCETYPE though, but the result is not what I expected.

Is there a way to disable a sourcetype please?
Thanks

0 Karma

Community Manager
Community Manager

Hi @Arkon

Did the answer by @somesoni2 solve your question? If yes, please don't forget to resolve the post by clicking "Accept" directly below his answer. Thanks!

Patrick

0 Karma

Revered Legend

There is no native way to disable a sourcetype and stop traffic/events for the sourcetype

1) If you want to stop traffic for that sourcetype, simply disable all data inputs (in inputs.conf files) which are sending data to that sourcetype and that data won't come into Splunk anymore. In the future, if you want to enable it, you're certainly free to activate the input.
2) If you want to remove events for that sourcetypes to not to returned in search result (assuming that sourcetype doesn't receive data anymore), just use delete (technically making it just not searchable, no diskspace will be reclaimed) the data for the sourcetype. See this for more details. http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/RemovedatafromSplunk
3) If you're not sure of what all inputs are sending that data, you can use this expensive method of routing all data for that sourcetype to null queue, so they won't get indexed. See this for more details http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Routeandfilterdatad#Filter_event_data_a...