Unfortunately, the question is how to remove sourcetypes -- not index data. I would like to do the same. I have created a number of "test" sourcetypes, which now appear in the dropdown list when importing new file data into Splunk. I have deleted all data which used the sourcetype as well as removing the relevant sections in props.conf (everywhere). Unfortunately, the sourcetypes still appear in the dropdown list.
Any thoughts on this? Thanks.
... View more