How to delete fields that I created in sourcetypes?

[Mat93]

Hi,

I created a source type.
Then I created new fields using delimiters.
I would like to delete those fields but I can't find how to do it.

I can't see them on the Settings > Fields > Field Extractions page.

I tried to delete the sourcetype by using the "soucetype=XX | delete" command
But when I recreate the sourcetype, fields are back...

Could you help me with this issue please ?

[maha4]

Use tool command check in transforms.conf

[richgalloway]

The delete command hides events. It has no effect on sourcetypes or other objects.

To delete the fields, edit the appropriate props.conf and remove the lines that create the fields. To find the right file, you can use 'splunk btool --debug props list '. Restart Splunk for the changes to take effect.

[Mat93]

Thank you for your replies.

To edit conf files, I need a direct access to the server ?
Or I can edit conf files from the web interface ?

[richgalloway]

Yes, you must have access to the server to be able to edit config files.