If you have Splunk Enterprise, you can use the rename attribute in props.conf to assign events to a new source type at search time. In case you ever need to search on it, the original source type is moved to a separate field, _sourcetype. Do the changes on the search Head. You can also refer to the below link to rename the sourcetype at search time. https://docs.splunk.com/Documentation/Splunk/8.0.1/Data/Renamesourcetypes ... View more

https://answers.splunk.com/answers/453991/find-the-duplicate-files-from-particular-source-in.html ... View more

Add a scheduled task The layout for a cron entry is made up of six components: minute, hour, day of month, month of year, day of week, and the command to be executed. m h dom mon dow command * * * * * command to execute ┬ ┬ ┬ ┬ ┬ │ │ │ │ │ │ │ │ │ │ │ │ │ │ └───── day of week (0 - 7) (0 to 6 are Sunday to Saturday, or use names; 7 is Sunday, the same as 0) │ │ │ └────────── month (1 - 12) │ │ └─────────────── day of month (1 - 31) │ └──────────────────── hour (0 - 23) └───────────────────────── min (0 - 59) Example expressions Here are some example cron expressions. */5 * * * * Every 5 minutes. */30 * * * * Every 30 minutes. 0 */12 * * * Every 12 hours, on the hour. */20 * * * 1-5 Every 20 minutes, Monday through Friday. 0 9 1-7 * * The first 7 days of every month at 9 AM. https://docs.splunk.com/Documentation/Splunk/8.0.1/Alert/CronExpressions ... View more

You can set indexes to keep your data for 180 days, just need to configure 'frozenTimePeriodInSecs' setting in indexes.conf. frozenTimePeriodInSecs = The number of seconds after which indexed data rolls to frozen. meaning: if "frozenTimePeriodInSecs" seconds have passed, data could prematurely roll to frozen Default: 188697600 (6 years) In your case: It is like- [] frozenTimePeriodInSecs = 15552000 (180 Days) ... View more