Splunk Search

Rename source

New Member

Hi,

I have created a data input in splunk but I want to change the name of the source now. Is there a way to do this?

Tags (1)
0 Karma

Revered Legend
0 Karma

Communicator

You can reindex with the new source, but once it is indexed Splunk is going to keep the events indexed as it was received. Which is why best practice would be to set up a test index you can use to verify you data is coming in as expected.

0 Karma

New Member

I have already tried this. This created two source names for me. Also, after editing the inputs.conf file to rename the source the new data gets indexed with the new source name and the data which was indexed prior to the rename remains with the old source name. This is not what I need.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!