Is there a way to disable a sourcetype in props.conf to no longer index these events?

[Arkon]

Hello,

I would like to disable a sourcetype defined in props.conf.
I do not want anymore events related to this sourcetype.
There is no disabled=1 in props.conf. I found LEARN_SOURCETYPE though, but the result is not what I expected.

Is there a way to disable a sourcetype please?
Thanks

[ppablo]

Hi @Arkon

Did the answer by @somesoni2 solve your question? If yes, please don't forget to resolve the post by clicking "Accept" directly below his answer. Thanks!

Patrick

[somesoni2]

There is no native way to disable a sourcetype and stop traffic/events for the sourcetype

1) If you want to stop traffic for that sourcetype, simply disable all data inputs (in inputs.conf files) which are sending data to that sourcetype and that data won't come into Splunk anymore. In the future, if you want to enable it, you're certainly free to activate the input.
2) If you want to remove events for that sourcetypes to not to returned in search result (assuming that sourcetype doesn't receive data anymore), just use delete (technically making it just not searchable, no diskspace will be reclaimed) the data for the sourcetype. See this for more details. http://docs.splunk.com/Documentation/Splunk/6.4.3/Indexer/RemovedatafromSplunk
3) If you're not sure of what all inputs are sending that data, you can use this expensive method of routing all data for that sourcetype to null queue, so they won't get indexed. See this for more details http://docs.splunk.com/Documentation/Splunk/6.4.3/Forwarding/Routeandfilterdatad#Filter_event_data_a...