Getting Data In

Rename sourcetype

vchigurupati
New Member

Hi, I want to rename the sourcetype for existing data with deleting the data from it and again indexing data because it's more difficult and over headache. So, any one please post the procedure that how I can rename the sourcetype. Or suggest me if I give alias to sourcetype for existing data is there any problems that I face in future.

0 Karma

DalJeanis
Legend

Are you saying that you have existing sourcetypes that are incorrect in your indexed data, and you want to update those existing indexes to move that information into a different field? And you would like to do that without having to delete the data and re-index it?

0 Karma

vchigurupati
New Member

yes, exactly I want to rename single source types to mutiple source types on already indexed data

0 Karma

cmerriman
Super Champion
0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...