Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

[clyde772]

Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Can I rename a type of pattern data into another "Souce Type"

or

I have to delete the type of source and reindex?

[jrodman]

In addition, you can make splunk treat sourcetype A as if it were sourcetype B for search purposes.

http://www.splunk.com/base/Documentation/4.1.2/Admin/Renamesourcetypes

This only allows you to cause ALL of sourcetype A to now be considered B.

[Simeon]

You Cannot rename a Source Type after it has already been indexed. However, you can use tags or aliases to alter the way you identify those events:

http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttagsandaliases