what happens to old events when props.conf is modified?

[martinh3]

Log files for a sourcetype called "logx" are being forwarded to my Splunk enterprise using forwarders from a few different hosts.
If I change props.conf to add new properties for the sourcetype "logx", will the changes take effect on all of the old logx events, as well as all of the new incoming logx events?
Background: I need to add a BREAK_ONLY_BEFORE property so that events contain all of the data they should contain.
I did a test myself with data that was manually imported to splunk, and the old events still looked the same - not good.
Then, I added a new file with the same sourcetype, and this new file looked great in Splunk, though the old events are no longer there.
Did I do something wrong, or is this what I should expect if I were to modify props.conf in our production env?

[richgalloway · Accepted solution]

Nothing can change what is already indexed except for the delete command. The behavior you describe is normal. To have a new props.conf apply to old data you need to re-index that data - export it to a file, delete the old events, then import the file. Try the export/import steps with a scratch index before you delete real data.