Splunk Dev

Is it possible to change the sourcetype of an ingested log to a different sourcetype without affecting the index?

Amoah
Explorer

I have wrongly ingested data to an existing index marked for syslog. I have noticed the error and would want changed the already ingested log to a different sourcetype? Let's say from syslog to access_combined. Is this possible? Has anyone come across this issue?

Tags (1)
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it.

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

As others have mentioned, you cannot alter data already indexed. If you correct the source type at the source so all new data utilizes the new sourcetype, the old data should eventually age out. You could also look at using an alias for the existing data with the wrong sourcetype:

http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Renamesourcetypes

Jacob
Sr. Technical Support Engineer

niketn
Legend

@Amoah you can check the collect command however, this will cost against license as by default collect command keeps sourcetype as stash and changing the same to some other sourcetype will be charged against license.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect#Moving_events_to_a_diffe...

PS: In your case index remains same but sourcetype changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it

0 Karma

splunker12er
Motivator

These are already indexed and you cannot modify - if you have the log backup then you may go ahead to delete (yoursearch sourcetype=syslog | delete)the previously indexed data and ingest the log with new source type

Amoah
Explorer

Thanks. I am appreciate it

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...

SplunkTrust | 2024 SplunkTrust Application Period is Open!

It's that time again, folks! That's right, the application/nomination period for the 2024 SplunkTrust is ...