Change a device type without affecting historical logs?

[RSAAdmin]

I have an IP address that's configured as multi-device (UNIX AIX and Oracle) in order to collect both AIX and Oracle logs from that device.

However for some unknown reason the enVision one day automatically created a third device type for this same IP called "Juniper JUNOS" and so now about half of the AIX logs for this IP are received/stored in the enVision as UNIX AIX logs, and the other half are received/stored as Juniper JUNOS logs.

It is as if there was a log event on that AIX server that occured one day that the enVision recognized as a Juniper JUNOS type of event, and so the enVision automatically created the new device type for this IP.

I don't think it's possible, but I wanted to confirm if there is a way to move back the logs for this IP recorded as Juniper JUNOS logs into the UNIX AIX logs, and to delete the Juniper JUNOS device. 

[RSAAdmin]

Unfortunately no - once logs have been identified and indexed as a particlar event source type there is no way to change them within the UI.

It is possible to export them via lsdata and then reinject them - then depending on the changes made they might be discovered correctly upon reinsertion, but your collection timestamp will be different if you do that. 

>>It is as if there was a log event on that AIX server that occured one day that the enVision recognized as a Juniper JUNOS type of event, and so the enVision automatically created the new device type for this IP.

This would happen if the AIX event source had been set as a multidevice and an unrecognized event showed up.  From that point forward, any other events unrecognized as AIX events that matched the Juniper JUNOS event format would be deposited there.

[RSAAdmin]

>>This would happen if the AIX event source had been set as a multidevice and an unrecognized event showed up.  From that point forward, any other events unrecognized as AIX events that matched the Juniper JUNOS event format would be deposited there.

Yeah that's what I thought.  Given that I'm collecting two types of logs for this same IP, I need to have multidevice checked.  Perhaps if there was a checkbox next to multidevice that you could check that would tell the RSA "Don't try to discover new device types for this IP address." so that if an unknown event type comes in that happens to look like the logs for device type X, the RSA doesn't create a new series of logs for device type X.