Splunk Dev

Is it possible to change the sourcetype of an ingested log to a different sourcetype without affecting the index?

Amoah
Explorer

I have wrongly ingested data to an existing index marked for syslog. I have noticed the error and would want changed the already ingested log to a different sourcetype? Let's say from syslog to access_combined. Is this possible? Has anyone come across this issue?

Tags (1)
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it.

0 Karma

jcrabb_splunk
Splunk Employee
Splunk Employee

As others have mentioned, you cannot alter data already indexed. If you correct the source type at the source so all new data utilizes the new sourcetype, the old data should eventually age out. You could also look at using an alias for the existing data with the wrong sourcetype:

http://docs.splunk.com/Documentation/Splunk/7.0.3/Data/Renamesourcetypes

Jacob
Sr. Technical Support Engineer

niketn
Legend

@Amoah you can check the collect command however, this will cost against license as by default collect command keeps sourcetype as stash and changing the same to some other sourcetype will be charged against license.

https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Collect#Moving_events_to_a_diffe...

PS: In your case index remains same but sourcetype changes.

____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

Amoah
Explorer

Thanks for the response. I am appreciate it

0 Karma

splunker12er
Motivator

These are already indexed and you cannot modify - if you have the log backup then you may go ahead to delete (yoursearch sourcetype=syslog | delete)the previously indexed data and ingest the log with new source type

Amoah
Explorer

Thanks. I am appreciate it

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...