how to take confs for firewall app into pretrained defaults "syslog" sourcetype

[Mag2sub]

WE have a syslog ng infrastructure dumping logs and read by splunk default sourcetype "syslog" with defaut extractions ...down the line discover a firewall app...with some good points..how does one midway change the firewall app that was a UDP monitor to be changed to become a file monitor and sourcetype also changed ? along with all the interesting knowledge objects of that app ?

Is there some graceful way to do this without cleaning out data ?

Thanks

[lukejadamec]

Create a new index for the file monitor.

Once you confirm that the monitor is recording data then you stop splunkd.

This will drop all new UDP messages, and roll the Monitor hot bucket to a warm bucket.

Next, with Splunk still stopped, delete the UDP input, and delete all of the warm buckets in the new Monitor index db folder.

Make note of the time (not really necessary).

To span the input break you need to call each index with the OR operator:

index=oldindex OR index=newindex

Restart Splunk.

The UDP inputs will no longer exist, and the monitor will pickup at the time Splunk was stopped (end UDP and start Monitor).

Might want to wait an hour or so before you try this for some real splunk guru to chime in. I'm a splunk guru in spirit only.