Getting Data In

Is there a way to disable a sourcetype in props.conf to no longer index these events?



I would like to disable a sourcetype defined in props.conf.
I do not want anymore events related to this sourcetype.
There is no disabled=1 in props.conf. I found LEARN_SOURCETYPE though, but the result is not what I expected.

Is there a way to disable a sourcetype please?

0 Karma


Hi @Arkon

Did the answer by @somesoni2 solve your question? If yes, please don't forget to resolve the post by clicking "Accept" directly below his answer. Thanks!


0 Karma

Revered Legend

There is no native way to disable a sourcetype and stop traffic/events for the sourcetype

1) If you want to stop traffic for that sourcetype, simply disable all data inputs (in inputs.conf files) which are sending data to that sourcetype and that data won't come into Splunk anymore. In the future, if you want to enable it, you're certainly free to activate the input.
2) If you want to remove events for that sourcetypes to not to returned in search result (assuming that sourcetype doesn't receive data anymore), just use delete (technically making it just not searchable, no diskspace will be reclaimed) the data for the sourcetype. See this for more details.
3) If you're not sure of what all inputs are sending that data, you can use this expensive method of routing all data for that sourcetype to null queue, so they won't get indexed. See this for more details

Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...