Can we delete user created sourcetypes on Splunk Cloud?

[Roy_9]

Hello,

Is it possible to delete user created sourcetypes on splunk cloud, i checked under all configurations and sourcetypes options but didn't found anything.

Anyone has an idea? I guess we need to open a case to splunk support for deletion?

Thanks

[Roy_9]

Hey @richgalloway 

I am on Splunk cloud and I don't see delete option under actions column, I can only see Edit and Clone.

Thanks

[richgalloway]

I use Splunk Cloud as well and sometime see a "Delete" option.  I don't know what makes it available.

The only other solution I can offer is to upload a new version of the app that contains that sourcetype, but without the sourcetype.

Either way, removing the sourcetype means events with that sourcetype may not be processed properly.

[Roy_9]

@richgalloway Thank you for sharing the instructions.

Meanwhile, I will open a case to Splunk support to see if they enable delete option atleast for sc_admin role.

[richgalloway]

Yes, you should be able to delete custom sourcetypes.  Go to Settings->Sourcetypes and the Actions column will contain "Delete" for those sourcetypes you can delete.  I don't know how Splunk decides which sourcetypes you can and cannot delete, however.