You cannot rename the source type for data that has already been indexed. You can do some things at search time, but since that is inefficient I won't go into it. Your best bet is likely sending the data feed to a heavy forwarder, setting the source types appropriately (inputs, props, transforms), and then kicking it to the indexers.
... View more
I would think that adding an additional column to your lookups containing the epoch time value for when the entry was created (or modified if you want that much granularity/complexity). From there it just becomes a matter of when to roll stale data out of the lookup.
... View more