Splunk Search

Why does Old sourcetype is shown even when it is removed from conf files

tkadale
Path Finder

I have indexed data for Linux logs. I have created different sourcetypes for it in props.conf. Now I removed the configuration for Linux logs and created new configuration for windows logs. I have created new sourcetypes for it. I re-indexed the data. But when I search, old sourcetype still exist even though it is removed from props.conf and data is re-indexed. Is the old configuration is also saved somewhere else??
Can anybody help??

Thanks in Advance!

Tags (1)
0 Karma

woodcock
Esteemed Legend

You are seeing old data; use "rename=" to rename the old sourcetype data to the new sourcetype's name in props.conf:


[OldSourceType]
rename=NewSourceType

0 Karma

jbsplunk
Splunk Employee
Splunk Employee

I can't tell from your post, but is this historical data that your seeing in the search? If so, this isn't going to go away unless you clean ALL eventdata from the index. All historical Sourcetypes will be retained until such time as they are purged out via your retention settings, which happen by age and size.

If you are seeing current data that is being categorized with an incorrect sourcetype, then it is likely that there is an existing configuration somewhere else that is telling Splunk to categorize this data in a certain way.

If this is a linux box from $SPLUNK_HOME/etc/ you could do something like

'find . -name *.conf | xargs grep -i yoursourcetype'

If your on windows, it should be easy to do this with the search functionality available.

This would show you any configuration that might reference this sourcetype.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...