https://community.splunk.com/t5/Splunk-Enterprise/How-to-Update-event-using-rest-api/m-p/518630#M3342 <P>once events are indexed in Splunk, you can't change you can modify in reporting. This is like strings in java. events are immutable after indexing.</P> Wed, 09 Sep 2020 09:03:56 GMT thambisetty 2020-09-09T09:03:56Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-Update-event-using-rest-api/m-p/518622#M3341 <P>We have create HTTP event collector event using postman through Rest API. Also we have few events created by uploading log file on our splunk enterprise instance.&nbsp;</P><P>&nbsp;Is update possible on events and what is Rest API for that?&nbsp;We didn't find any api in documentation.</P> Wed, 09 Sep 2020 08:31:17 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-Update-event-using-rest-api/m-p/518622#M3341 pallavi_prabhu_ 2020-09-09T08:31:17Z https://community.splunk.com/t5/Splunk-Enterprise/How-to-Update-event-using-rest-api/m-p/518630#M3342 <P>once events are indexed in Splunk, you can't change you can modify in reporting. This is like strings in java. events are immutable after indexing.</P> Wed, 09 Sep 2020 09:03:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-to-Update-event-using-rest-api/m-p/518630#M3342 thambisetty 2020-09-09T09:03:56Z