In order to completely replace the old sourcetype name with a new sourcetype name, you will have to delete the data from the index and completely reindex it.
This is a difficult task in a production environment. After you read this, you may decide that the rename option is your best choice.
You can delete the individual events using the delete command, or you can clean the entire index.
If you clean the index, then Splunk can reindex the files and directories when it restarts. (Although if you are using forwarders, you will have to reset each forwarder to resend its data. That could be messy and difficult.)
Also, if you clean the index, you could lose data from scripted inputs and network inputs - and it might not be possible to recover this data.
If you use the delete command, though, you will have to manually reload only the data that was deleted. Again, this may be extremely difficult if this data is spread across your environment.
Finally, regardless of which option you chose, when you re-index the data, it will count against your Splunk daily license volume.
This is why most installations keep a staging or testing instance of Splunk around: so they can do a trial load of new data and make sure they get the sourcetype (and other settings) right, before they load any data into production...
