Splunk Search
Highlighted

How to delete fields that I created in sourcetypes?

New Member

Hi,

I created a source type.
Then I created new fields using delimiters.
I would like to delete those fields but I can't find how to do it.

I can't see them on the Settings > Fields > Field Extractions page.

I tried to delete the sourcetype by using the "soucetype=XX | delete" command
But when I recreate the sourcetype, fields are back...

Could you help me with this issue please ?

0 Karma
Highlighted

Re: How to delete fields that I created in sourcetypes?

SplunkTrust
SplunkTrust

The delete command hides events. It has no effect on sourcetypes or other objects.

To delete the fields, edit the appropriate props.conf and remove the lines that create the fields. To find the right file, you can use 'splunk btool --debug props list '. Restart Splunk for the changes to take effect.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: How to delete fields that I created in sourcetypes?

New Member

Thank you for your replies.

To edit conf files, I need a direct access to the server ?
Or I can edit conf files from the web interface ?

0 Karma
Highlighted

Re: How to delete fields that I created in sourcetypes?

SplunkTrust
SplunkTrust

Yes, you must have access to the server to be able to edit config files.

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: How to delete fields that I created in sourcetypes?

New Member

Use tool command check in transforms.conf

0 Karma