props.conf
Reindexing is more complex. You would have to remove the old and then reindex it all to set the sourcetype at index time properly. You can set the sourcetype on index time with a setting in inputs.conf for the monitor stanza (the easiest method) or you can get a little more complex with doing event inspection and overriding it before index time: http://docs.splunk.com/Documentation/Splunk/latest/Data/Advancedsourcetypeoverrides
... View more