topic Re: Modify an Event in a particular index in Splunk Enterprise

How to modify an Event in a particular index?

kanishka97167 — Wed, 29 Jun 2022 23:15:30 GMT

I am trying to add data into Splunk in Json format. All the events have the same format. Lets say we have some format like this:

[

field1 : value1

field2 : value2

]

Is is possible for me to update value1 to some value3, given field1? I am looking to first achieve this from website and if this possible, I am looking for REST APIs to achieve the same.

Re: Modify an Event in a particular index

isoutamo — Wed, 29 Jun 2022 20:10:40 GMT

You must do this before events have indexed. After those are written to disk you cannot change those.

If you want to change those values before indexing that maybe do by props and transforms. But maybe it's easier to do it totally outside of Splunk?

Can you open with more details what is your issue which you are trying to solve?

Re: Modify an Event in a particular index

kanishka97167 — Wed, 29 Jun 2022 20:59:15 GMT

Hi isoutamo,

Thanks a lot for the quick response. I am basically trying to add data real time into Splunk for visualization using some dashboards. I am concerned with 3 operations here: Add, Delete and Modify. Adding and Deleting records works fine. But I am unable to find any resources to modify any existing events.

Also Could you please help me find some resources where I can add or delete events using the REST APIs that Splunk provides? I am specifically looking for these:

1. Add an event into a particular index

2. Given an index and field name(specific field name in the Json formatted event), delete that event from the index.