We have changed the configuration (props.conf) on a Universal Forwarder so that it will now use the correct sourcetype for a couple of log files.
How do I go about getting
a) the forwarder to "resend" the events in those files with the new correct source type
b) getting the indexer to re-index those events.
Alternatively, is there a way to change the source type for those events at the indexer?
... View more