how to sync sourcetype for already indexed content

[dhavamanis]

We have created new sourcetype (acquia_access_combined) and associated in props.conf and transforms.conf. Can you please tell us how to sync with new sourcetype for already indexed log to avoid field extraction. but log format is common before and after. also we don't have existing log files in the source.

old sourcetype : syslog
new sourcetype : acquia_access_combined

[starcher]

source type is an index time field. you cannot change it once it is indexed. the best you can do is go under fields and go under fields in settings and use source type renaming which helps alias it at search time. However renaming syslog to that your type is probably not the best idea. Your best bet is to reindex the events.