Getting Data In
Highlighted

Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Communicator

Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Can I rename a type of pattern data into another "Souce Type"

or

I have to delete the type of source and reindex?

Tags (1)
Highlighted

Re: Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Motivator

You Cannot rename a Source Type after it has already been indexed. However, you can use tags or aliases to alter the way you identify those events:

http://www.splunk.com/base/Documentation/latest/Knowledge/Abouttagsandaliases

Highlighted

Re: Would I be able to rename a "Source Type" after the data got already indexed into Splunk?

Champion

In addition, you can make splunk treat sourcetype A as if it were sourcetype B for search purposes.

http://www.splunk.com/base/Documentation/4.1.2/Admin/Renamesourcetypes

This only allows you to cause ALL of sourcetype A to now be considered B.

Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.