Getting Data In

Rename sourcetype

New Member

Hi, I want to rename the sourcetype for existing data with deleting the data from it and again indexing data because it's more difficult and over headache. So, any one please post the procedure that how I can rename the sourcetype. Or suggest me if I give alias to sourcetype for existing data is there any problems that I face in future.

0 Karma

SplunkTrust
SplunkTrust

Are you saying that you have existing sourcetypes that are incorrect in your indexed data, and you want to update those existing indexes to move that information into a different field? And you would like to do that without having to delete the data and re-index it?

0 Karma

New Member

yes, exactly I want to rename single source types to mutiple source types on already indexed data

0 Karma

Super Champion
0 Karma