Getting Data In
Highlighted

Need to disable Source Type

Path Finder

Hi I was testing splunk by adding source types. But now my splunk indexer has all kinds of stuff that I don't need.I want to disable one source type with option so i can use in future if required. i can't find the solution for that Please help me out.Regards,
Nikhil

Tags (2)
Highlighted

Re: Need to disable Source Type

Splunk Employee
Splunk Employee

I am not entirely sure what your asking. If you want to 'disable' a sourcetype, you can simply remove the input associated with that sourcetype, and that data won't come into Splunk anymore. In the future, if you want to enable it, you're certainly free to activate the input.

If you're saying that you want to remove data from the index, you can't do it in such a way as to reclaim space without removing everything in the index.

You probably want to take a look at this link, which gives you all the options for removing data:

http://docs.splunk.com/Documentation/Splunk/latest/admin/RemovedatafromSplunk

You can use the | delete command to delete(mask) data from showing up in future searches, so if you'd like to do that, it is entirely possible.

You can use splunk clean to remove all the data from the index. Both options are described in the document to which I had linked.

0 Karma
Highlighted

Re: Need to disable Source Type

Explorer

Unfortunately, the question is how to remove sourcetypes -- not index data. I would like to do the same. I have created a number of "test" sourcetypes, which now appear in the dropdown list when importing new file data into Splunk. I have deleted all data which used the sourcetype as well as removing the relevant sections in props.conf (everywhere). Unfortunately, the sourcetypes still appear in the dropdown list.

Any thoughts on this? Thanks.

0 Karma