Rename sourcetype

[vchigurupati]

Hi, I want to rename the sourcetype for existing data with deleting the data from it and again indexing data because it's more difficult and over headache. So, any one please post the procedure that how I can rename the sourcetype. Or suggest me if I give alias to sourcetype for existing data is there any problems that I face in future.

[DalJeanis]

Are you saying that you have existing sourcetypes that are incorrect in your indexed data, and you want to update those existing indexes to move that information into a different field? And you would like to do that without having to delete the data and re-index it?

[vchigurupati]

yes, exactly I want to rename single source types to mutiple source types on already indexed data

[cmerriman]

You could try renaming the sourcetype at search time:
https://docs.splunk.com/Documentation/Splunk/6.5.2/Data/Renamesourcetypes

there is also an Answers on this:
https://answers.splunk.com/answers/145936/how-to-rename-sourcetype-in-props-conf.html