i want to rename the sourcetype of my app. when i searched splunk docs i came to know that there is an option called rename to do this, but
"The indexed events still contain the original source type name. The renaming occurs only at search time. "
i dont want to keep old name of the sourcetype.
how can i completely replace oldsourcetypename to newsourcetypename.
If you clean the index, then Splunk can reindex the files and directories when it restarts. (Although if you are using forwarders, you will have to reset each forwarder to resend its data. That could be messy and difficult.)
Also, if you clean the index, you could lose data from scripted inputs and network inputs - and it might not be possible to recover this data.
If you use the delete command, though, you will have to manually reload only the data that was deleted. Again, this may be extremely difficult if this data is spread across your environment.
Finally, regardless of which option you chose, when you re-index the data, it will count against your Splunk daily license volume.
This is why most installations keep a staging or testing instance of Splunk around: so they can do a trial load of new data and make sure they get the sourcetype (and other settings) right, before they load any data into production...