Splunk Enterprise

How can to delete these leftover source types and basically start over? Is deleting the whole index the only way?

zith
Loves-to-Learn

Hi!

I've installed DB Connect for the first time today and can successfully get data from Oracle. While testing I've created a couple DB connect inputs with new sourcestypes (some name is required during creation) that I no longer need and that seem to be interfering with data processing - ex. new columns that I've added in SQL are not visible in new events after data fetch. I'd like to delete those source types but:

* they do not show up in Settings > Source Types
* they do show up in `| metadata type=sourcetypes index=myidx` but I don't know how to delete them using SPL

How can I delete these leftover zombie source types and basically start over. Is deleting the whole index the only way?

Labels (1)
0 Karma

zith
Loves-to-Learn

"Show only popular" was unchecked.

I'm not sure what you mean by needing to look on the DB connect splunk server. We currently have a single server installation. There is no separate DB Connect server nor do I see any sourcetype management related stuff inside the DB Connect App.

Anyway, I've deleted and re-created the whole index. Problem solved, I guess 😉

0 Karma

mayurr98
Super Champion

Hi please make sure "show only popular " box is unchecked in Settings > Source Types to get all the list of sourcetypes. also look for the sourcetypes on the server it is created so if you have create a sourcetype on the DB connect splunk server then look there to delete the specific sourcetype.

Please refer to this document: 

https://docs.splunk.com/Documentation/Splunk/8.2.5/Data/Managesourcetypes#Delete_a_source_type 

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...