Rename source

[sriva6]

Hi,

I have created a data input in splunk but I want to change the name of the source now. Is there a way to do this?

[somesoni2]

This post can help you with that.

http://answers.splunk.com/answers/90656/renaming-sourcetype-and-source-with-props-and-transforms

[antlefebvre]

You can reindex with the new source, but once it is indexed Splunk is going to keep the events indexed as it was received. Which is why best practice would be to set up a test index you can use to verify you data is coming in as expected.

[sriva6]

I have already tried this. This created two source names for me. Also, after editing the inputs.conf file to rename the source the new data gets indexed with the new source name and the data which was indexed prior to the rename remains with the old source name. This is not what I need.