Splunk Dev

Is it possible to change the sourcetype of an ingested log to a different sourcetype without affecting the index?

Amoah
Explorer

I have wrongly ingested data to an existing index marked for syslog. I have noticed the error and would want changed the already ingested log to a different sourcetype? Let's say from syslog to access_combined. Is this possible? Has anyone come across this issue?

Tags (1)
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it.

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

As others have mentioned, you cannot alter data already indexed. If you correct the source type at the source so all new data utilizes the new sourcetype, the old data should eventually age out. You could also look at using an alias for the existing data with the wrong sourcetype:

http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Renamesourcetypes

Jacob
Sr. Technical Support Engineer

niketn
Legend

@Amoah you can check the collect command however, this will cost against license as by default collect command keeps sourcetype as stash and changing the same to some other sourcetype will be charged against license.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect#Moving_events_to_a_diffe...

PS: In your case index remains same but sourcetype changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it

0 Karma

splunker12er
Motivator

These are already indexed and you cannot modify - if you have the log backup then you may go ahead to delete (yoursearch sourcetype=syslog | delete)the previously indexed data and ingest the log with new source type

Amoah
Explorer

Thanks. I am appreciate it

0 Karma
Get Updates on the Splunk Community!

.conf25 Registration is OPEN!

Ready. Set. Splunk! Your favorite Splunk user event is back and better than ever. Get ready for more technical ...

Detecting Cross-Channel Fraud with Splunk

This article is the final installment in our three-part series exploring fraud detection techniques using ...

Splunk at Cisco Live 2025: Learning, Innovation, and a Little Bit of Mr. Brightside

Pack your bags (and maybe your dancing shoes)—Cisco Live is heading to San Diego, June 8–12, 2025, and Splunk ...