Need to disable Source Type

[nikhilagrawal]

Hi I was testing splunk by adding source types. But now my splunk indexer has all kinds of stuff that I don't need.I want to disable one source type with option so i can use in future if required. i can't find the solution for that Please help me out.Regards,
Nikhil

[lesterw]

Unfortunately, the question is how to remove sourcetypes -- not index data. I would like to do the same. I have created a number of "test" sourcetypes, which now appear in the dropdown list when importing new file data into Splunk. I have deleted all data which used the sourcetype as well as removing the relevant sections in props.conf (everywhere). Unfortunately, the sourcetypes still appear in the dropdown list.

Any thoughts on this? Thanks.

[jbsplunk]

I am not entirely sure what your asking. If you want to 'disable' a sourcetype, you can simply remove the input associated with that sourcetype, and that data won't come into Splunk anymore. In the future, if you want to enable it, you're certainly free to activate the input.

If you're saying that you want to remove data from the index, you can't do it in such a way as to reclaim space without removing everything in the index.

You probably want to take a look at this link, which gives you all the options for removing data:

http://docs.splunk.com/Documentation/Splunk/latest/admin/RemovedatafromSplunk

You can use the | delete command to delete(mask) data from showing up in future searches, so if you'd like to do that, it is entirely possible.

You can use splunk clean to remove all the data from the index. Both options are described in the document to which I had linked.