topic Is there any possible to modify raw data in Splunk in Splunk Enterprise

Is there any possible to modify raw data in Splunk

jenniferhao — Thu, 27 May 2021 19:02:55 GMT

hello,

we have some raw data with one field wrong from April. But we cannot reload data from the source. Is there any way that we can modify only one field? for example:

_time id name value:

20210406 1 "SMT" 60 to be 20210406 1 "Node" 60

20210416 100 "SMT" 80 to be 20210416 100 "Node" 80

Re: Is there any possible to modify raw data in Splunk

richgalloway — Thu, 27 May 2021 20:25:12 GMT

Ingested data is immutable. There is no way to change, modify, or edit data once it's in a Splunk index.

The best you can do is add logic to your queries to replace "SMT" with "Node" in the name field. Once the April data expires you can remove that logic.

Re: Is there any possible to modify raw data in Splunk

jenniferhao — Thu, 27 May 2021 20:44:35 GMT

Thanks. But the issue not all of "SMT" in April was wrong. Only part of them need to be update. Anyway, thanks for your reply.