Why does Old sourcetype is shown even when it is removed from conf files

[tkadale]

I have indexed data for Linux logs. I have created different sourcetypes for it in props.conf. Now I removed the configuration for Linux logs and created new configuration for windows logs. I have created new sourcetypes for it. I re-indexed the data. But when I search, old sourcetype still exist even though it is removed from props.conf and data is re-indexed. Is the old configuration is also saved somewhere else??
Can anybody help??

Thanks in Advance!

[woodcock]

You are seeing old data; use "rename=" to rename the old sourcetype data to the new sourcetype's name in props.conf:

[OldSourceType]

rename=NewSourceType

[jbsplunk]

I can't tell from your post, but is this historical data that your seeing in the search? If so, this isn't going to go away unless you clean ALL eventdata from the index. All historical Sourcetypes will be retained until such time as they are purged out via your retention settings, which happen by age and size.

If you are seeing current data that is being categorized with an incorrect sourcetype, then it is likely that there is an existing configuration somewhere else that is telling Splunk to categorize this data in a certain way.

If this is a linux box from $SPLUNK_HOME/etc/ you could do something like

'find . -name *.conf | xargs grep -i yoursourcetype'

If your on windows, it should be easy to do this with the search functionality available.

This would show you any configuration that might reference this sourcetype.